Exchange compliance search created

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Office 365 Audit
Detection Modules	Identity Threat Module, SaaS Threat Detection, Email
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Email Collection (T1114)
Severity	Informational

Description

A user created an Exchange compliance search. This feature enables Administrators to search mailboxes in an organization.

Attacker's Goals

An attacker is searching mailboxes to access sensitive information.

Investigative actions

• Follow further actions done by the account.
• Check to see if the search contained sensitive information.
• Check if any data was exfiltrated after the search.
• Look for suspicious search terms.

Variations

Suspicious Exchange compliance search created

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Email Collection (T1114)
Severity	Low

Description

A user created an Exchange compliance search. This feature enables Administrators to search mailboxes in an organization. The query contains potentially suspicious keywords, which could indicate an attempt of sensitive data collection.

Attacker's Goals

An attacker is searching mailboxes to access sensitive information.

Investigative actions

• Follow further actions done by the account.
• Check to see if the search contained sensitive information.
• Check if any data was exfiltrated after the search.
• Look for suspicious search terms.

Exchange compliance search created for the first time

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Email Collection (T1114)
Severity	Low

Description

A user created an Exchange compliance search. This feature enables Administrators to search mailboxes in an organization.

Attacker's Goals

An attacker is searching mailboxes to access sensitive information.

Investigative actions

• Follow further actions done by the account.
• Check to see if the search contained sensitive information.
• Check if any data was exfiltrated after the search.
• Look for suspicious search terms.