Suspicious PST Export Alert Via New-ComplianceSearchAction (via threat_management)

title: Suspicious PST Export Alert Via New-ComplianceSearchAction (via threat_management)
id: 72509864-fa89-555c-9af4-f402d4bdd5ec
status: stable
description: This rule detects when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell use and from the cloud.
references:
    - https://attack.mitre.org/techniques/T1114/
    - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps
author: Huntrule Team
date: 2026-03-01
tags:
    - attack.collection
    - attack.t1114
logsource:
    service: threat_management
    product: m365
detection:
    selection:
        eventSource: SecurityComplianceCenter
        Payload|contains|all:
            - 'New-ComplianceSearchAction'
            - 'Export'
            - 'pst'
    condition: selection
falsepositives:
    - Unknown
level: medium