| elastic |
New ActiveSyncAllowedDeviceID Added via PowerShell |
production |
2026-09-18 |
| elastic |
Microsoft Graph Email Access by Unusual User and Client |
production |
2026-09-18 |
| elastic |
Google Workspace Gmail Routing or Forwarding Rule Created or Modified |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Items Accessed Excessively |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
M365 Exchange Inbox Forwarding Rule Created |
production |
2026-09-18 |
| elastic |
M365 Exchange Mail Flow Transport Rule Created |
production |
2026-09-18 |
| elastic |
Suspicious Inter-Process Communication via Outlook |
production |
2026-09-18 |
| elastic |
Exporting Exchange Mailbox via PowerShell |
production |
2026-09-18 |
| elastic |
Exchange Mailbox Export via PowerShell |
production |
2026-09-18 |
| elastic |
PowerShell Mailbox Collection Script |
production |
2026-09-18 |
| suricata |
ET MALWARE JS ZimReaper Zimbra Mailbox Archive Export |
rev 1 |
2026-07-21 |
| snort |
ET TROJAN JS ZimReaper Zimbra Mailbox Archive Export |
rev 1 |
2026-07-21 |
| splunk |
O365 New Forwarding Mailflow Rule Created |
production |
2026-05-13 |
| splunk |
O365 PST export alert |
production |
2026-05-13 |
| sigma |
Exchange PowerShell Snap-Ins Usage |
test |
2023-03-24 |
| sigma |
PST Export Alert Using eDiscovery Alert |
test |
2022-11-17 |
| sigma |
PST Export Alert Using New-ComplianceSearchAction |
test |
2022-11-17 |
| sigma |
Hacktool Ruler |
test |
2022-10-09 |
| sentinel |
NRT Multiple users email forwarded to same destination |
NRT |
— |
| sentinel |
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account |
Scheduled |
— |