name: O365 PST export alert
id: 5f694cc4-a678-4a60-9410-bffca1b647dc
version: 1
date: '2020-12-16'
author: Rod Soto, Splunk
type: batch
datamodel: []
description: This search detects when a user has performed an Ediscovery search or
  exported a PST file from the search. This PST file usually has sensitive information
  including email body content
search: '`o365_management_activity` Category=ThreatManagement Name="eDiscovery search
  started or exported" | stats count earliest(_time) as firstTime latest(_time) as
  lastTime by Source Severity AlertEntityId Operation Name |`security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
  works with o365:management:activity
known_false_positives: PST export can be done for legitimate purposes but due to the
  sensitive nature of its content it must be monitored.
references:
- https://attack.mitre.org/techniques/T1114/
tags:
  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_export_pst_file/o365_export_pst_file.json
  kill_chain_phases:
  - Actions on Objective
  mitre_attack_id:
  - T1114
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Category
  - Name
  - Source
  - Severity
  - AlertEntityId
  - Operation
  security_domain: threat
