m365:unified
Microsoft 365 Unified Audit Log
Event keys are Operation names (Exchange, SharePoint, Teams, Entra via UAL)
- Host type
- Microsoft 365
- Tier, as a whole
- Minimum
- Cost class
- Included
- Techniques
- 76
- Rules listed
- 197
- Events
- 125
Why this tier
CISA M365 playbook; CISA-SCUBA-M365; CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A10 (Attack vectors and lateral movement; our analysis); OMB M-26-14 A3 (Object and data events; our analysis); OMB M-26-14 A4 (Privilege changes; our analysis); OMB M-26-14 A7 (Indicators of compromise; our analysis); OMB M-26-14 A8 (Anomalous activity; our analysis); OMB M-26-14 A9 (Data affected; our analysis)
Licensing
- License or service
- M365 E3/A3/G3/F3/F1; O365 E1/E3/F3; Business Basic/Standard/Premium
- What is free
- 180-day retention (90 before 2023-10-17); on by default
- What costs
- Nothing beyond base license
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Identity used | Supports an activity | our analysis: UserId on every operation |
| OMB M-26-14: Object and data events | Supports an activity | our analysis: FileAccessed FileModified FileDeleted MailItemsAccessed operations |
| OMB M-26-14: Privilege changes | Supports an activity | our analysis: Add member to role |
| OMB M-26-14: Indicators of compromise | Supports an activity | our analysis: mail and sign-in indicators |
| OMB M-26-14: Anomalous activity | Supports an activity | our analysis: mass download and forwarding anomalies |
| OMB M-26-14: Data affected | Supports an activity | our analysis: FileDownloaded FileSyncDownloadedFull MailItemsAccessed |
| OMB M-26-14: Attack vectors and lateral movement | Supports an activity | our analysis: phishing delivery and mailbox rules |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: email servers; use of the tenant's user accounts that access and administer cloud services |
| CISA SCuBA: Audit logging policies | names_source | quoted: MS.DEFENDER.6.1v1 Unified Audit logging SHALL be enabled |
| CISA SCuBA: Audit logging policies | names_source | quoted: MS.DEFENDER.6.3v1 audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (rescinded; see M-26-14) |
Techniques
- T1021.007 Cloud Services
- T1069.003 Cloud Groups
- T1070 Indicator Removal
- T1070.008 Clear Mailbox Data
- T1078.004 Cloud Accounts
- T1080 Taint Shared Content
- T1087 Account Discovery
- T1087.003 Email Account
- T1098 Account Manipulation
- T1098.001 Additional Cloud Credentials
- T1098.002 Additional Email Delegate Permissions
- T1098.003 Additional Cloud Roles
- T1110 Brute Force
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1114 Email Collection
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1136.003 Cloud Account
- T1137 Office Application Startup
- T1137.001 Office Template Macros
- T1137.002 Office Test
- T1137.003 Outlook Forms
- T1137.004 Outlook Home Page
- T1137.005 Outlook Rules
- T1189 Drive-by Compromise
- T1199 Trusted Relationship
- T1201 Password Policy Discovery
- T1207 Rogue Domain Controller
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1213 Data from Information Repositories
- T1213.002 Sharepoint
- T1213.005 Messaging Applications
- T1213.006 Databases
- T1484 Domain or Tenant Policy Modification
- T1484.002 Trust Modification
- T1496 Resource Hijacking
- T1526 Cloud Service Discovery
- T1528 Steal Application Access Token
- T1530 Data from Cloud Storage
- T1531 Account Access Removal
- T1534 Internal Spearphishing
- T1537 Transfer Data to Cloud Account
- T1538 Cloud Service Dashboard
- T1539 Steal Web Session Cookie
- T1546 Event Triggered Execution
- T1548.005 Temporary Elevated Cloud Access
- T1550 Use Alternate Authentication Material
- T1550.001 Application Access Token
- T1550.004 Web Session Cookie
- T1552.008 Chat Messages
- T1556 Modify Authentication Process
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1564 Hide Artifacts
- T1564.008 Email Hiding Rules
- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.004 Spearphishing Voice
- T1567 Exfiltration Over Web Service
- T1567.004 Exfiltration Over Webhook
- T1606 Forge Web Credentials
- T1606.001 Web Cookies
- T1606.002 SAML Tokens
- T1648 Serverless Execution
- T1649 Steal or Forge Authentication Certificates
- T1657 Financial Theft
- T1667 Email Bombing
- T1671 Cloud Application Integration
- T1684 Social Engineering
- T1684.001 Impersonation
- T1685.002 Disable or Modify Cloud Log
- T1687 Exploitation for Defense Impairment
- T1697 Steal Application Specific Passwords
Rules
Splunk 72
- High Number of Login Failures from a single source
- O365 Add App Role Assignment Grant User
- O365 Added Service Principal
- O365 Admin Consent Bypassed by Service Principal
- O365 Advanced Audit Disabled
- O365 Application Available To Other Tenants
- O365 Application Registration Owner Added
- O365 ApplicationImpersonation Role Assigned
- O365 Block User Consent For Risky Apps Disabled
- O365 Bypass MFA via Trusted IP
- O365 Concurrent Sessions From Different Ips
- O365 Cross-Tenant Access Change
- O365 DLP Rule Triggered
- O365 Disable MFA
- O365 Elevated Mailbox Permission Assigned
- O365 Email Access By Security Administrator
- O365 Email Hard Delete Excessive Volume
- O365 Email New Inbox Rule Created
- O365 Email Password and Payroll Compromise Behavior
- O365 Email Receive and Hard Delete Takeover Behavior
- O365 Email Reported By Admin Found Malicious
- O365 Email Reported By User Found Malicious
- O365 Email Security Feature Changed
- O365 Email Send Attachments Excessive Volume
- O365 Email Send and Hard Delete Exfiltration Behavior
- O365 Email Send and Hard Delete Suspicious Behavior
- O365 Email Suspicious Behavior Alert
- O365 Email Suspicious Search Behavior
- O365 Email Transport Rule Changed
- O365 Excessive SSO logon errors
- O365 Exfiltration via File Access
- O365 Exfiltration via File Download
- O365 Exfiltration via File Sync Download
- O365 External Guest User Invited
- O365 External Identity Policy Changed
- O365 File Permissioned Application Consent Granted by User
- O365 FullAccessAsApp Permission Assigned
- O365 High Number Of Failed Authentications for User
- O365 High Privilege Role Granted
- O365 Mail Permissioned Application Consent Granted by User
- O365 Mailbox Folder Read Permission Assigned
- O365 Mailbox Folder Read Permission Granted
- O365 Mailbox Inbox Folder Shared with All Users
- O365 Mailbox Read Access Granted to Application
- O365 Multi-Source Failed Authentications Spike
- O365 Multiple AppIDs and UserAgents Authentication Spike
- O365 Multiple Failed MFA Requests For User
- O365 Multiple Mailboxes Accessed via API
- O365 Multiple OS Vendors Authenticating From User
- O365 Multiple Service Principals Created by SP
- O365 Multiple Service Principals Created by User
- O365 Multiple Users Failing To Authenticate From Ip
- O365 New Federated Domain Added
- O365 New MFA Method Registered
- O365 OAuth App Mailbox Access via EWS
- O365 OAuth App Mailbox Access via Graph API
- O365 PST export alert
- O365 Privileged Graph API Permission Assigned
- O365 Privileged Role Assigned
- O365 Privileged Role Assigned To Service Principal
- O365 Safe Links Detection
- O365 Service Principal New Client Credentials
- O365 Service Principal Privilege Escalation
- O365 SharePoint Allowed Domains Policy Changed
- O365 SharePoint Malware Detection
- O365 SharePoint Suspicious Search Behavior
- O365 Tenant Wide Admin Consent Granted
- O365 Threat Intelligence Suspicious Email Delivered
- O365 Threat Intelligence Suspicious File Detected
- O365 User Consent Blocked for Risky Application
- O365 User Consent Denied for OAuth Application
- O365 ZAP Activity Detection
Sigma 21
- Activity Performed by Terminated User by Austin Songer @austinsonger
- Activity from Anonymous IP Addresses by Austin Songer @austinsonger
- Activity from Infrequent Country by Austin Songer @austinsonger
- Activity from Suspicious IP Addresses by Austin Songer @austinsonger
- Azure Login Bypassing Conditional Access Policies by Josh Nickels, Marius Rothenbücher
- Data Exfiltration to Unsanctioned Apps by Austin Songer @austinsonger
- Disabling Multi Factor Authentication by Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)
- Inbox Rules Creation Or Update Activity in O365 by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- Logon from a Risky IP Address by Austin Songer @austinsonger
- Mail Forwarding/Redirecting Activity In O365 by RedCanary Team (idea), Harjot Singh @cyb3rjy0t
- Microsoft 365 - Impossible Travel Activity by Austin Songer @austinsonger
- Microsoft 365 - Potential Ransomware Activity by austinsonger
- Microsoft 365 - Unusual Volume of File Deletion by austinsonger
- Microsoft 365 - User Restricted from Sending Email by austinsonger
- New Federated Domain Added by Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)
- New Federated Domain Added - Exchange by Splunk Threat Research Team (original rule), '@ionsor (rule)'
- PST Export Alert Using New-ComplianceSearchAction by Nikita Khalimonenkov
- PST Export Alert Using eDiscovery Alert by Sorina Ionescu
- Suspicious Email Delivered In Microsoft 365 by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- Suspicious Inbox Forwarding by Austin Songer @austinsonger
- Suspicious OAuth App File Download Activities by Austin Songer @austinsonger
Elastic 61
- Deprecated - M365 Exchange DLP Policy Deleted
- Deprecated - M365 Security Compliance Potential Ransomware Activity
- Deprecated - M365 Security Compliance Unusual Volume of File Deletion
- Deprecated - M365 Security Compliance User Restricted from Sending Email
- Deprecated - M365 Teams External Access Enabled
- Deprecated - M365 Teams Guest Access Enabled
- Entra ID Kali365 Default User-Agent Detected
- Entra ID Sign-in BloodHound Suite User-Agent Detected
- Entra ID Sign-in TeamFiltration User-Agent Detected
- M365 AIR Investigation Signal
- M365 Defender Alerts Signal (UAL)
- M365 Entra ID Risk Detection Signal
- M365 Exchange Anti-Phish Policy Deleted
- M365 Exchange Anti-Phish Rule Modification
- M365 Exchange DKIM Signing Configuration Disabled
- M365 Exchange Email Safe Attachment Rule Disabled
- M365 Exchange Email Safe Link Policy Disabled
- M365 Exchange Federated Domain Created or Modified
- M365 Exchange Inbox Forwarding Rule Created
- M365 Exchange Inbox Phishing Evasion Rule Created
- M365 Exchange Inbox Rule with Obfuscated Name
- M365 Exchange MFA Notification Email Deleted or Moved
- M365 Exchange Mail Flow Transport Rule Created
- M365 Exchange Mail Flow Transport Rule Modified
- M365 Exchange Mailbox Accessed by Unusual Client
- M365 Exchange Mailbox Audit Logging Bypass Added
- M365 Exchange Mailbox High-Risk Permission Delegated
- M365 Exchange Mailbox Items Accessed Excessively
- M365 Exchange Malware Filter Policy Deleted
- M365 Exchange Malware Filter Rule Modified
- M365 Exchange Management Group Role Assigned
- M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device)
- M365 Identity Device Code Grant with Unusual User and ASN
- M365 Identity Global Administrator Role Assigned
- M365 Identity Login from Atypical Region
- M365 Identity Login from Impossible Travel Location
- M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs
- M365 Identity OAuth Flow by User Sign-in to Device Registration
- M365 Identity OAuth Illicit Consent Grant by Rare Client and User
- M365 Identity OAuth Phishing via First-Party Microsoft Application
- M365 Identity OAuth ROPC Grant via Legacy Authentication Client
- M365 Identity Unusual SSO Authentication Errors for User
- M365 Identity User Account Lockouts
- M365 Identity User Brute Force Attempted
- M365 OneDrive Malware File Upload
- M365 OneDrive/SharePoint Excessive File Downloads
- M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)
- M365 Purview DLP Signal
- M365 Purview Insider Risk Signal
- M365 Purview Security Compliance Signal
- M365 Quarantine and Hygiene Signal
- M365 Security Compliance Admin Signal
- M365 SharePoint Malware File Detected
- M365 SharePoint Search for Sensitive Content
- M365 SharePoint Site Administrator Added
- M365 SharePoint Site Sharing Policy Weakened
- M365 SharePoint/OneDrive File Access via PowerShell
- M365 Teams Custom Application Interaction Enabled
- M365 Teams Rogue Help Desk Chat Created
- M365 Threat Intelligence Signal
- M365 or Entra ID Identity Sign-in from a Suspicious Source
Microsoft Sentinel 43
- Accessed files shared by temporary external user
- Anomalous login followed by Teams action
- Dataverse - Executable uploaded to SharePoint document management site
- Dataverse - Malware found in SharePoint document management site
- Dataverse - Mass download from SharePoint document management
- Dataverse - New user agent type that was not used with Office 365
- Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt
- Europium - Hash and IP IOCs - September 2022
- Exchange AuditLog Disabled
- Exchange workflow MailItemsAccessed operation anomaly
- External user added and removed in short timeframe
- GreyNoise TI map IP entity to OfficeActivity
- High risk Office operation conducted by IP Address that recently attempted to log into a disabled account
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Lumen TI IPAddress in OfficeActivity
- Mail redirect via ExO transport rule
- Malformed user agent
- Malicious BEC Inbox Rule
- Malicious Inbox Rule
- Mercury - Domain, Hash and IP IOCs - August 2022
- Multiple Password Reset by user
- Multiple Teams deleted by a single user
- Multiple users email forwarded to same destination
- NRT Malicious Inbox Rule
- NRT Multiple users email forwarded to same destination
- New UserAgent observed in last 24 hours
- New executable via Office FileUploaded Operation
- Office Policy Tampering
- Office365 Sharepoint File transfer Folders above threshold
- Office365 Sharepoint File transfer above threshold
- Rare and potentially high-risk Office operations
- SharePointFileOperation via devices with previously unseen user agents
- SharePointFileOperation via previously unseen IPs
- TI Map Email entity to OfficeActivity
- TI Map IP entity to OfficeActivity
- TI Map URL Entity to OfficeActivity Data [Deprecated]
- TI map Email entity to OfficeActivity
- TI map IP entity to OfficeActivity
- Threat Essentials - Mail redirect via ExO transport rule
- ThreatConnect TI Map URL Entity to OfficeActivity Data
- ThreatConnect TI map Email entity to OfficeActivity
- User agent search for log4j exploitation attempt
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022
Events
Minimum (8)
Recommended (54)
- Add-DelegatedAdmin
- Add-InboxRule
- AnonymousLinkCreated
- AttachmentPreviewed
- ChatRetrieved
- Clear-Mailbox
- ClickThrough
- Consent to application
- ConsentGranted
- FailedLogin
- FileAccessed
- Get-DistributionGroup
- Get-RoleGroup
- MailboxAccessed
- MeetingDetail
- MeetingParticipantDetail
- MessageHostedContentRead
- MessageRead
- MessageSend
- MessageSent
- MessagesListed
- MessageUpdated
- ModifyFolderPermissions
- New-ManagementRoleAssignment
- New-TransportRule
- OAuthTokenIssued
- PurgeAuditLogs
- RegisterWebhook
- Remove-InboxRule
- Remove-Mailbox
- Remove-MailboxAuditLog
- RunMacro
- SearchQueried
- SearchQueryInitiatedExchange
- SearchQueryInitiatedSharePoint
- Send
- SendMessage
- SendOnBehalf
- Set-AppPassword
- Set-MailboxFolderPermission
- Set-MailboxPolicy
- Set-OrganizationRelationship
- Set-PartnerOfRecord
- Set-TransportRule
- Set-TrustedLocation
- SharingSet
- TeamsGraphMessageExport
- TeamsMessagesAccessedViaEDiscovery
- to
- TokenIssued
- Update application
- UpdateFolderPermissions
- UserLoginFailed
- ViewAdminReport
Listed (63)
- Add
- Add app role assignment grant to user
- Add app role assignment to service principal
- Add member to role
- Add owner to application
- Add service principal
- Add-FederatedDomain
- Add-MailboxFolderPermission
- Add-RecipientPermission
- AppInstalled
- BotAddedToTeam
- Change user license
- ChatCreated
- Consent
- deletion
- Disable Strong Authentication
- Disable-AntiPhishRule
- Disable-MalwareFilterRule
- Disable-SafeAttachmentRule
- Disable-SafeLinksRule
- Disable-TransportRule
- file
- FileMalwareDetected
- from
- HardDelete
- member
- MemberAdded
- MemberRemoved
- MemberRoleChanged
- MoveToDeletedItems
- New-AcceptedDomain
- of
- PasswordLogonInitialAuthUsingPassword
- registered
- Remove-AcceptedDomain
- Remove-AntiPhishPolicy
- Remove-AntiPhishRule
- Remove-DlpPolicy
- Remove-FederatedDomain
- Remove-MalwareFilterPolicy
- Remove-MalwareFilterRule
- Remove-TransportRule
- restricted
- SearchQueryPerformed
- sending
- Set Company Information
- Set-AcceptedDomain
- Set-AdminAuditLogConfig
- Set-CsTeamsClientConfiguration
- Set-CsTenantFederationConfiguration
- Set-DkimSigningConfig
- Set-MsolDomainFederationSettings
- SharingPolicyChanged
- SoftDelete
- TeamDeleted
- TeamsAdminAction
- Unusual
- Update authorization policy
- Update user
- User
- users
- volume