O365 message trace detections: support o365:graph:messagetrace (Office 365 add-on 6.x)

detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml

@@ -1,21 +1,23 @@
 name: O365 Email Password and Payroll Compromise Behavior
 id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96
-version: 7
+version: 8
 creation_date: '2025-01-23'
-modification_date: '2026-05-13'
+modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: TTP
-description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
+description: |-
+    The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period.
+    This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
 data_source:
     - Office 365 Universal Audit Log
     - Office 365 Reporting Message Trace
 search: |-
     `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
     | eval mailtime = _time
     | bin _time span=4hr
-    | eval user = lower(RecipientAddress)
-    | eval InternetMessageId = lower(MessageId)
+    | eval user = lower(recipient)
+    | eval InternetMessageId = lower(message_id)
     | join InternetMessageId, user max=0
       [
       | search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete")
@@ -32,8 +34,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_password_and_payroll_compromise_behavior_filter`
-how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: No false positives have been identified at this time.
+how_to_implement: |-
+    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: |-
+    No false positives have been identified at this time.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -48,7 +52,7 @@ drilldown_searches:
       earliest_offset: 7d
       latest_offset: "0"
     - name: Investigate Email for $user$
-      search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") RecipientAddress = "$user$"'
+      search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") recipient = "$user$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
 finding:
@@ -86,3 +90,12 @@ tests:
           source: o365_messagetrace
           sourcetype: o365:reporting:messagetrace
       test_type: unit
+    - name: True Positive Test - Graph message trace
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
+          source: o365
+          sourcetype: o365:management:activity
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
+          source: o365_messagetrace
+          sourcetype: o365:graph:messagetrace
+      test_type: unit

detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml

@@ -1,21 +1,23 @@
 name: O365 Email Receive and Hard Delete Takeover Behavior
 id: b66aeaa4-586f-428b-8a2b-c4fd3039d8d3
-version: 6
+version: 7
 creation_date: '2025-01-23'
-modification_date: '2026-05-13'
+modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: Anomaly
-description: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
+description: |-
+    The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period.
+    This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
 data_source:
     - Office 365 Universal Audit Log
     - Office 365 Reporting Message Trace
 search: |-
     `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*")
     | eval mailtime = _time
     | bin _time span=4hr
-    | eval user = lower(RecipientAddress)
-    | eval InternetMessageId = lower(MessageId)
+    | eval user = lower(recipient)
+    | eval InternetMessageId = lower(message_id)
     | join InternetMessageId, user max=0
       [
       | search `o365_management_activity` Workload=Exchange Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")
@@ -31,8 +33,10 @@ search: |-
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_receive_and_hard_delete_takeover_behavior_filter`
-how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: Possible new user/account onboarding processes.
+how_to_implement: |-
+    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: |-
+    Possible new user/account onboarding processes.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -47,7 +51,7 @@ drilldown_searches:
       earliest_offset: 7d
       latest_offset: "0"
     - name: Investigate Email for $user$
-      search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND RecipientAddress = "$user$"'
+      search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND recipient = "$user$"'
       earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
 intermediate_findings:
@@ -87,3 +91,12 @@ tests:
           source: o365_messagetrace
           sourcetype: o365:reporting:messagetrace
       test_type: unit
+    - name: True Positive Test - Graph message trace
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
+          source: o365
+          sourcetype: o365:management:activity
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
+          source: o365_messagetrace
+          sourcetype: o365:graph:messagetrace
+      test_type: unit

detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml

@@ -1,21 +1,24 @@
 name: O365 Email Send and Hard Delete Exfiltration Behavior
 id: dd7798cf-c4f5-4114-ad0f-beacd9a33708
-version: 6
+version: 7
 creation_date: '2025-01-23'
-modification_date: '2026-05-13'
+modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: Anomaly
-description: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.
+description: |-
+    The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour).
+    This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity.
+    This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.
 data_source:
     - Office 365 Universal Audit Log
     - Office 365 Reporting Message Trace
 search: |-
-    `o365_messagetrace` Status=Delivered
+    `o365_messagetrace` status_code=Delivered
     | eval mailtime = _time
     | bin _time span=1hr
-    | eval user = lower(SenderAddress), recipient = lower(RecipientAddress)
-    | eval InternetMessageId = lower(MessageId)
+    | eval user = lower(src_user), recipient = lower(recipient)
+    | eval InternetMessageId = lower(message_id)
     | join InternetMessageId, user, max=0
       [
       | search `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions"))
@@ -26,14 +29,16 @@ search: |-
       | stats values(sender) as sender, values(ClientInfoString) as http_user_agent, values(InternetMessageId) as InternetMessageId, values(file_name) as file_name, sum(file_size) as file_size, values(sendtime) as firstTime, values(deltime) as lastTime values(Operation) as signature, dc(Operation) as opcount, count by _time,subject,user
       | where opcount > 1 AND firstTime < lastTime
       ]
-    | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime  count by subject,user,recipient,Organization
-    | eval externalRecipient = if(match(lower(recipient),mvindex(split(lower(Organization),"."),0)),0,1)
+    | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime  count by subject,user,recipient
+    | eval externalRecipient = if(mvindex(split(lower(recipient),"@"),1)==mvindex(split(lower(user),"@"),1),0,1)
     | where externalRecipient = 1
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_send_and_hard_delete_exfiltration_behavior_filter`
-how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
+how_to_implement: |-
+    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: |-
+    Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -90,3 +95,12 @@ tests:
           source: o365_messagetrace
           sourcetype: o365:reporting:messagetrace
       test_type: unit
+    - name: True Positive Test - Graph message trace
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
+          source: o365
+          sourcetype: o365:management:activity
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
+          source: o365_messagetrace
+          sourcetype: o365:graph:messagetrace
+      test_type: unit

detections/cloud/o365_email_send_attachments_excessive_volume.yml

@@ -1,20 +1,24 @@
 name: O365 Email Send Attachments Excessive Volume
 id: 70a050a2-8537-488a-a628-b60a9558d96a
-version: 6
+version: 7
 creation_date: '2025-01-23'
-modification_date: '2026-05-13'
+modification_date: '2026-09-23'
 author: Steven Dick
 status: production
 type: Anomaly
-description: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
+description: |-
+    The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
+    This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
+    Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
+    Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
 data_source:
     - Office 365 Universal Audit Log
 search: |-
-    `o365_messagetrace` Status=Delivered
+    `o365_messagetrace` status_code=Delivered
     | eval mailtime = _time
     | bin _time span=1hr
-    | eval user = lower(SenderAddress), recipient = lower(RecipientAddress)
-    | eval InternetMessageId = lower(MessageId)
+    | eval user = lower(src_user), recipient = lower(recipient)
+    | eval InternetMessageId = lower(message_id)
     | join InternetMessageId, user, _time max=0
       [
       | search `o365_management_activity` Workload=Exchange Operation IN ("Send","SendAs","SendOnBehalf")
@@ -27,14 +31,16 @@ search: |-
       | eval file_name = mvjoin(file_name,"||")
       ]
     | eval file_name = split(file_name,"||")
-    | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,Organization,InternetMessageId
+    | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,InternetMessageId
     | eval recipient = mvmap(recipient, if(match(mvindex(split(lower(recipient),"@"),1),mvindex(split(lower(user),"@"),1)), null(),recipient))
     | search recipient = *
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `o365_email_send_attachments_excessive_volume_filter`
-how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
-known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly.
+how_to_implement: |-
+    You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events.
+known_false_positives: |-
+    Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly.
 references:
     - https://attack.mitre.org/techniques/T1114/
     - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
@@ -84,3 +90,12 @@ tests:
           source: o365_messagetrace
           sourcetype: o365:reporting:messagetrace
       test_type: unit
+    - name: True Positive Test - Graph message trace
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log
+          source: o365
+          sourcetype: o365:management:activity
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
+          source: o365_messagetrace
+          sourcetype: o365:graph:messagetrace
+      test_type: unit

macros/o365_messagetrace.yml

@@ -1,8 +1,8 @@
 name: o365_messagetrace
 id: 1ead5eb3-85e8-40fb-9eb4-6936843f08d6
-version: 1
+version: 2
 creation_date: '2025-01-23'
-modification_date: '2026-05-13'
+modification_date: '2026-09-23'
 author: Splunk Threat Research Team
 description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
-definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace")
+definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace","o365:graph:messagetrace")