GitHub Repo

Microsoft 365 Detections

Name Data Source Technique Type Analytic Story Date
O365 ApplicationImpersonation Role Assigned O365 T1098.002 TTP Office 365 Collection Techniques, NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 BEC Email Hiding Rule Created T1564.008 TTP Office 365 Account Takeover 2026-09-22
O365 Privileged Role Assigned To Service Principal Office 365 Universal Audit Log T1098.003 TTP Scattered Lapsus$ Hunters, Azure Active Directory Privilege Escalation 2026-09-22
O365 Exfiltration via File Download Office 365 Universal Audit Log T1530 T1567 Anomaly Office 365 Account Takeover, Data Exfiltration 2026-05-13
O365 Mailbox Inbox Folder Shared with All Users O365 ModifyFolderPermissions T1114.002 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 Mailbox Read Access Granted to Application O365 Update application. T1098.003 T1114.002 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 User Consent Denied for OAuth Application O365 T1528 TTP Office 365 Account Takeover 2026-05-13
O365 Mail Permissioned Application Consent Granted by User O365 Consent to application. T1528 TTP Office 365 Account Takeover 2026-05-13
O365 Email Reported By Admin Found Malicious Office 365 Universal Audit Log T1566.001 T1566.002 TTP Suspicious Emails, Spearphishing Attachments 2026-05-13
O365 File Permissioned Application Consent Granted by User O365 Consent to application. T1528 TTP Office 365 Account Takeover 2026-05-13
O365 Excessive SSO logon errors O365 UserLoginFailed T1556 Anomaly Office 365 Account Takeover, Cloud Federated Credential Abuse 2026-05-13
O365 SharePoint Allowed Domains Policy Changed Office 365 Universal Audit Log T1136.003 TTP Azure Active Directory Persistence 2026-05-13
O365 Service Principal Privilege Escalation O365 Add app role assignment grant to user. T1098.003 TTP Azure Active Directory Privilege Escalation, Office 365 Account Takeover 2026-05-13
O365 Exfiltration via File Sync Download Office 365 Universal Audit Log T1530 T1567 Anomaly Office 365 Account Takeover, Data Exfiltration 2026-05-13
O365 Email Send and Hard Delete Exfiltration Behavior Office 365 Universal Audit Log, Office 365 Reporting Message Trace T1070.008 T1114.001 T1485 Anomaly Office 365 Collection Techniques, Office 365 Account Takeover, Data Destruction, Suspicious Emails 2026-09-23
O365 Threat Intelligence Suspicious File Detected Office 365 Universal Audit Log T1204.002 TTP Office 365 Account Takeover, Azure Active Directory Account Takeover, Ransomware Cloud 2026-05-13
O365 Email Password and Payroll Compromise Behavior Office 365 Universal Audit Log, Office 365 Reporting Message Trace T1070.008 T1114.001 T1485 TTP Office 365 Collection Techniques, Office 365 Account Takeover, Data Destruction, Suspicious Emails 2026-09-23
O365 Email Send Attachments Excessive Volume Office 365 Universal Audit Log T1070.008 T1485 Anomaly Suspicious Emails, Office 365 Account Takeover 2026-09-23
O365 Exfiltration via File Access Office 365 Universal Audit Log T1530 T1567 Anomaly Office 365 Account Takeover, Data Exfiltration 2026-05-13
O365 Privileged Role Assigned Office 365 Universal Audit Log T1098.003 TTP Azure Active Directory Persistence, Scattered Lapsus$ Hunters 2026-09-22
O365 Email Suspicious Search Behavior Office 365 Universal Audit Log T1114.002 T1552 Anomaly Office 365 Collection Techniques, Office 365 Account Takeover, CISA AA22-320A, Compromised User Account 2026-05-13
O365 FullAccessAsApp Permission Assigned O365 Update application. T1098.002 T1098.003 TTP NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 Email Hard Delete Excessive Volume Office 365 Universal Audit Log T1070.008 T1485 Anomaly Suspicious Emails, Office 365 Account Takeover, Data Destruction 2026-05-13
O365 OAuth App Mailbox Access via EWS O365 MailItemsAccessed T1114.002 TTP Office 365 Collection Techniques, NOBELIUM Group 2026-05-13
O365 Safe Links Detection Office 365 Universal Audit Log T1566.001 TTP Office 365 Account Takeover, Spearphishing Attachments 2026-05-13
O365 Add App Role Assignment Grant User O365 Add app role assignment grant to user. T1136.003 TTP Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms 2026-05-13
O365 Mailbox Email Forwarding Enabled T1114.003 TTP Office 365 Collection Techniques 2026-05-13
O365 Email Access By Security Administrator Office 365 Universal Audit Log T1114.002 T1567 TTP Office 365 Account Takeover, Azure Active Directory Account Takeover, Data Exfiltration 2026-05-13
O365 Email Security Feature Changed Office 365 Universal Audit Log T1685.002 TTP Office 365 Account Takeover, Office 365 Persistence Mechanisms 2026-05-13
O365 Email Receive and Hard Delete Takeover Behavior Office 365 Universal Audit Log, Office 365 Reporting Message Trace T1070.008 T1114.001 T1485 Anomaly Office 365 Collection Techniques, Office 365 Account Takeover, Data Destruction, Suspicious Emails 2026-09-23
O365 DLP Rule Triggered Office 365 Universal Audit Log T1048 T1567 Anomaly Data Exfiltration 2026-05-13
O365 Email New Inbox Rule Created Office 365 Universal Audit Log T1114.003 T1564.008 Anomaly Office 365 Collection Techniques 2026-05-13
O365 SharePoint Malware Detection Office 365 Universal Audit Log T1204.002 TTP Azure Active Directory Persistence, Office 365 Account Takeover, Ransomware Cloud 2026-05-13
O365 Application Registration Owner Added O365 Add owner to application. T1098 TTP NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 Compliance Content Search Started T1114.002 TTP Office 365 Collection Techniques 2026-05-13
O365 Disable MFA O365 Disable Strong Authentication. T1556 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 Multiple Mailboxes Accessed via API O365 MailItemsAccessed T1114.002 TTP Office 365 Collection Techniques, NOBELIUM Group 2026-05-13
O365 Multiple Service Principals Created by User O365 Add service principal. T1136.003 Anomaly NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 Concurrent Sessions From Different Ips O365 UserLoggedIn T1185 TTP Scattered Lapsus$ Hunters, Office 365 Account Takeover 2026-05-13
O365 External Identity Policy Changed Office 365 Universal Audit Log T1136.003 TTP Azure Active Directory Persistence 2026-05-13
O365 Email Suspicious Behavior Alert Office 365 Universal Audit Log T1114.003 TTP Suspicious Emails, Office 365 Account Takeover, Office 365 Collection Techniques 2026-05-13
O365 Cross-Tenant Access Change Office 365 Universal Audit Log T1484.002 TTP Azure Active Directory Persistence 2026-05-13
O365 User Consent Blocked for Risky Application O365 Consent to application. T1528 TTP Office 365 Account Takeover 2026-05-13
O365 Multiple Users Failing To Authenticate From Ip O365 UserLoginFailed T1110.003 T1110.004 T1586.003 TTP Office 365 Account Takeover, NOBELIUM Group 2026-05-13
O365 Advanced Audit Disabled O365 Change user license. T1685.002 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 PST export alert O365 T1114 TTP Office 365 Collection Techniques, Data Exfiltration 2026-05-13
O365 Tenant Wide Admin Consent Granted O365 Consent to application. T1098.003 TTP NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 Security And Compliance Alert Triggered T1078.004 TTP Office 365 Account Takeover 2026-05-13
O365 Bypass MFA via Trusted IP O365 Set Company Information. T1686.001 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 Compliance Content Search Exported T1114.002 TTP Office 365 Collection Techniques 2026-05-13
O365 SharePoint Suspicious Search Behavior Office 365 Universal Audit Log T1213.002 T1552 Anomaly Office 365 Collection Techniques, Office 365 Account Takeover, CISA AA22-320A, Compromised User Account 2026-05-13
O365 Elevated Mailbox Permission Assigned O365 Add-MailboxPermission T1098.002 TTP Office 365 Collection Techniques 2026-05-13
O365 Multiple Service Principals Created by SP O365 Add service principal. T1136.003 Anomaly NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 New Federated Domain Added O365 T1136.003 TTP Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms 2026-05-13
O365 Threat Intelligence Suspicious Email Delivered Office 365 Universal Audit Log T1566.001 T1566.002 Anomaly Suspicious Emails, Spearphishing Attachments 2026-05-13
O365 Multi-Source Failed Authentications Spike O365 UserLoginFailed T1110.003 T1110.004 T1586.003 Hunting Office 365 Account Takeover, NOBELIUM Group 2026-05-13
O365 Excessive Authentication Failures Alert T1110 Anomaly Office 365 Account Takeover 2026-05-13
O365 High Privilege Role Granted O365 Add member to role. T1098.003 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 Application Available To Other Tenants Office 365 Universal Audit Log T1098.003 TTP Azure Active Directory Persistence, Azure Active Directory Account Takeover, Data Exfiltration 2026-05-13
O365 Email Send and Hard Delete Suspicious Behavior Office 365 Universal Audit Log T1070.008 T1114.001 T1485 Anomaly Office 365 Collection Techniques, Office 365 Account Takeover, Data Destruction, Suspicious Emails 2026-05-13
O365 New Forwarding Mailflow Rule Created T1114 TTP Office 365 Collection Techniques 2026-05-13
O365 Email Reported By User Found Malicious Office 365 Universal Audit Log T1566.001 T1566.002 TTP Suspicious Emails, Spearphishing Attachments 2026-05-13
O365 New MFA Method Registered O365 Update user. T1098.005 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 External Guest User Invited Office 365 Universal Audit Log T1136.003 TTP Azure Active Directory Persistence 2026-05-13
O365 ZAP Activity Detection Office 365 Universal Audit Log T1566.001 T1566.002 Anomaly Suspicious Emails, Spearphishing Attachments 2026-05-13
O365 Privileged Graph API Permission Assigned O365 Update application. T1003.002 TTP NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 New Email Forwarding Rule Created T1114.003 TTP Office 365 Collection Techniques 2026-05-13
O365 Admin Consent Bypassed by Service Principal O365 Add app role assignment to service principal. T1098.003 TTP Office 365 Persistence Mechanisms 2026-05-13
O365 Mailbox Folder Read Permission Assigned O365 ModifyFolderPermissions T1098.002 TTP Office 365 Collection Techniques 2026-05-13
O365 Multiple Failed MFA Requests For User O365 UserLoginFailed T1621 TTP Scattered Lapsus$ Hunters, Office 365 Account Takeover 2026-05-13
O365 Service Principal New Client Credentials O365 T1098.001 TTP NOBELIUM Group, Office 365 Persistence Mechanisms 2026-05-13
O365 New Email Forwarding Rule Enabled T1114.003 TTP Office 365 Collection Techniques 2026-05-13
O365 Mailbox Folder Read Permission Granted O365 ModifyFolderPermissions T1098.002 TTP Office 365 Collection Techniques 2026-05-13
O365 OAuth App Mailbox Access via Graph API O365 MailItemsAccessed T1114.002 TTP Office 365 Collection Techniques, NOBELIUM Group 2026-05-13
O365 Block User Consent For Risky Apps Disabled O365 Update authorization policy. T1685 TTP Office 365 Account Takeover 2026-05-13
O365 Email Transport Rule Changed Office 365 Universal Audit Log T1114.003 T1564.008 Anomaly Office 365 Account Takeover, Data Exfiltration 2026-05-13
O365 Multiple AppIDs and UserAgents Authentication Spike O365 UserLoggedIn, O365 UserLoginFailed T1078 Anomaly Office 365 Account Takeover 2026-05-13
High Number of Login Failures from a single source O365 UserLoginFailed T1110.001 Anomaly Office 365 Account Takeover 2026-05-13
O365 Multiple OS Vendors Authenticating From User Office 365 Universal Audit Log T1110 TTP Office 365 Account Takeover 2026-05-13
O365 High Number Of Failed Authentications for User O365 UserLoginFailed T1110.001 TTP Office 365 Account Takeover 2026-05-13
O365 Added Service Principal O365 T1136.003 TTP NOBELIUM Group, Cloud Federated Credential Abuse, Office 365 Persistence Mechanisms 2026-05-13