This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
Microsoft 365 Unusual Volume of File Deletion
editMicrosoft 365 Unusual Volume of File Deletion
editIdentifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security.
Rule type: query
Rule indices:
- filebeat-*
- logs-o365*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-30m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Elastic
- Cloud
- Microsoft 365
- Continuous Monitoring
- SecOps
- Configuration Audit
Version: 101 (version history)
Added (Elastic Stack release): 7.16.0
Last modified (Elastic Stack release): 8.6.0
Rule authors: Austin Songer
Rule license: Elastic License v2
Potential false positives
editUsers or System Administrator cleaning out folders.
Investigation guide
editRule query
editevent.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Unusual volume of file deletion" and event.outcome:success
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Impact
- ID: TA0040
- Reference URL: https://attack.mitre.org/tactics/TA0040/
-
Technique:
- Name: Data Destruction
- ID: T1485
- Reference URL: https://attack.mitre.org/techniques/T1485/
Rule version history
edit- Version 101 (8.6.0 release)
-
- Formatting only
- Version 100 (8.5.0 release)
-
- Formatting only
- Version 4 (8.4.0 release)
-
- Formatting only
- Version 2 (8.1.0 release)
-
- Formatting only