From a6363d1b083caac00e1d1c02930f3761949a11ac Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Wed, 23 Sep 2026 14:00:17 -0500 Subject: [PATCH 1/3] O365 message trace: support o365:graph:messagetrace sourcetype Splunk Add-on for Microsoft Office 365 6.x collects message trace through Microsoft Graph and emits sourcetype o365:graph:messagetrace with camelCase fields (senderAddress, recipientAddress, messageId, status) instead of the PascalCase fields of the retired Reporting web service sourcetypes. - Add o365:graph:messagetrace to the o365_messagetrace macro. - Switch the four dependent detections from raw field names to the CIM fields the add-on aliases for both sourcetypes: status_code, recipient, src_user, message_id. Behaviour is unchanged on the legacy sourcetypes. - Replace the Organization field, which the Graph sourcetype does not carry, with a sender-domain vs recipient-domain comparison. - Update drilldowns to use recipient. Affected: O365 Email Password and Payroll Compromise Behavior, O365 Email Receive and Hard Delete Takeover Behavior, O365 Email Send and Hard Delete Exfiltration Behavior, O365 Email Send Attachments Excessive Volume. Co-Authored-By: Claude Fable 5.1 --- ...il_password_and_payroll_compromise_behavior.yml | 10 +++++----- ...l_receive_and_hard_delete_takeover_behavior.yml | 10 +++++----- ..._send_and_hard_delete_exfiltration_behavior.yml | 14 +++++++------- ...365_email_send_attachments_excessive_volume.yml | 12 ++++++------ macros/o365_messagetrace.yml | 6 +++--- 5 files changed, 26 insertions(+), 26 deletions(-) diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml index e48b35f375..ad13032a70 100644 --- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml +++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml @@ -1,8 +1,8 @@ name: O365 Email Password and Payroll Compromise Behavior id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96 -version: 7 +version: 8 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: TTP @@ -14,8 +14,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete") @@ -48,7 +48,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ finding: diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml index 5362379aa3..c22faea93b 100644 --- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml +++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml @@ -1,8 +1,8 @@ name: O365 Email Receive and Hard Delete Takeover Behavior id: b66aeaa4-586f-428b-8a2b-c4fd3039d8d3 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly @@ -14,8 +14,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions") @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ intermediate_findings: diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml index 5fc9037fee..fd57ecc2f5 100644 --- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml +++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml @@ -1,8 +1,8 @@ name: O365 Email Send and Hard Delete Exfiltration Behavior id: dd7798cf-c4f5-4114-ad0f-beacd9a33708 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly @@ -11,11 +11,11 @@ data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, max=0 [ | search `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) @@ -26,8 +26,8 @@ search: |- | stats values(sender) as sender, values(ClientInfoString) as http_user_agent, values(InternetMessageId) as InternetMessageId, values(file_name) as file_name, sum(file_size) as file_size, values(sendtime) as firstTime, values(deltime) as lastTime values(Operation) as signature, dc(Operation) as opcount, count by _time,subject,user | where opcount > 1 AND firstTime < lastTime ] - | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient,Organization - | eval externalRecipient = if(match(lower(recipient),mvindex(split(lower(Organization),"."),0)),0,1) + | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient + | eval externalRecipient = if(mvindex(split(lower(recipient),"@"),1)==mvindex(split(lower(user),"@"),1),0,1) | where externalRecipient = 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml index 3842d035ee..2d4bfd555c 100644 --- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml +++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml @@ -1,8 +1,8 @@ name: O365 Email Send Attachments Excessive Volume id: 70a050a2-8537-488a-a628-b60a9558d96a -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly @@ -10,11 +10,11 @@ description: The following analytic identifies when an O365 email account sends data_source: - Office 365 Universal Audit Log search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, _time max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("Send","SendAs","SendOnBehalf") @@ -27,7 +27,7 @@ search: |- | eval file_name = mvjoin(file_name,"||") ] | eval file_name = split(file_name,"||") - | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,Organization,InternetMessageId + | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,InternetMessageId | eval recipient = mvmap(recipient, if(match(mvindex(split(lower(recipient),"@"),1),mvindex(split(lower(user),"@"),1)), null(),recipient)) | search recipient = * | `security_content_ctime(firstTime)` diff --git a/macros/o365_messagetrace.yml b/macros/o365_messagetrace.yml index 390f011741..2b530a58f2 100644 --- a/macros/o365_messagetrace.yml +++ b/macros/o365_messagetrace.yml @@ -1,8 +1,8 @@ name: o365_messagetrace id: 1ead5eb3-85e8-40fb-9eb4-6936843f08d6 -version: 1 +version: 2 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Splunk Threat Research Team description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace") +definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace","o365:graph:messagetrace") From 1f742a2d2630269bbbd4dc80141d4819831d09f6 Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Wed, 23 Sep 2026 14:05:16 -0500 Subject: [PATCH 2/3] O365 message trace detections: add Graph sourcetype unit tests Second test per detection replays the same four suspect messages in the o365:graph:messagetrace shape (companion attack_data change adds o365_graph_messagetrace_suspect_events.log). The legacy test is kept to prove backward compatibility with o365:reporting:messagetrace. Co-Authored-By: Claude Fable 5.1 --- ...65_email_password_and_payroll_compromise_behavior.yml | 9 +++++++++ ...5_email_receive_and_hard_delete_takeover_behavior.yml | 9 +++++++++ ..._email_send_and_hard_delete_exfiltration_behavior.yml | 9 +++++++++ .../o365_email_send_attachments_excessive_volume.yml | 9 +++++++++ 4 files changed, 36 insertions(+) diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml index ad13032a70..2baa3f0267 100644 --- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml +++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml @@ -86,3 +86,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml index c22faea93b..08362080a6 100644 --- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml +++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml @@ -87,3 +87,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml index fd57ecc2f5..9bba904f10 100644 --- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml +++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml @@ -90,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml index 2d4bfd555c..987a356f3c 100644 --- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml +++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml @@ -84,3 +84,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit From 6883f3fe63222fa82f38048691d30aba19d51a9f Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Thu, 24 Sep 2026 16:47:28 -0500 Subject: [PATCH 3/3] O365 message trace detections: reflow prose fields to block style Convert description, how_to_implement and known_false_positives to |- block scalars with one sentence per line, matching the repo's detection YAML style. No content changes. Co-Authored-By: Claude Opus 5.5 --- ...mail_password_and_payroll_compromise_behavior.yml | 10 +++++++--- ...ail_receive_and_hard_delete_takeover_behavior.yml | 10 +++++++--- ...il_send_and_hard_delete_exfiltration_behavior.yml | 11 ++++++++--- .../o365_email_send_attachments_excessive_volume.yml | 12 +++++++++--- 4 files changed, 31 insertions(+), 12 deletions(-) diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml index 2baa3f0267..9b4d1e6d12 100644 --- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml +++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml @@ -6,7 +6,9 @@ modification_date: '2026-09-23' author: Steven Dick status: production type: TTP -description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -32,8 +34,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_password_and_payroll_compromise_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml index 08362080a6..51c0ec9f30 100644 --- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml +++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml @@ -6,7 +6,9 @@ modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -31,8 +33,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_receive_and_hard_delete_takeover_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Possible new user/account onboarding processes. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Possible new user/account onboarding processes. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml index 9bba904f10..174bf25eb1 100644 --- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml +++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml @@ -6,7 +6,10 @@ modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. +description: |- + The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. + This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -32,8 +35,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_and_hard_delete_exfiltration_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml index 987a356f3c..1616e1a270 100644 --- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml +++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml @@ -6,7 +6,11 @@ modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. +description: |- + The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. + Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. + Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. data_source: - Office 365 Universal Audit Log search: |- @@ -33,8 +37,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_attachments_excessive_volume_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf