Detection Pack Microsoft 365

Microsoft 365 Detection Pack

78 detection rules for the complete Microsoft 365 estate — Exchange Online, SharePoint, Teams, OneDrive, and M365 Defender. Business email compromise, insider threat, and ransomware precursor detections included.

Activate this pack M365 integration docs

Pack summary

Detection rules: 78
Critical severity: 22
M365 services covered: 6
ATT&CK techniques: 28

What's included

78 rules across 6 threat categories for the full M365 estate.

Business Email Compromise 22 rules

Forwarding rules, mailbox delegation, eDiscovery abuse, BCC transport rules, phishing delivery.

Data Exfiltration 20 rules

SharePoint mass download, OneDrive sync to unmanaged device, Power Automate data export.

M365 Defender Alerts 14 rules

High-severity Defender incidents correlated with raw audit events.

Admin & Policy Abuse 12 rules

Admin role to guest, DLP policy disable, safe links bypass, audit log disabling.

External Sharing & Federation 6 rules

SharePoint external links, Teams federation, external guest access without MFA.

Identity Threats 4 rules

Conditional Access exclusion additions, OWA re-enablement, impossible travel.

Detection rules (20 of 78 shown)

Showing 20 representative rules. All 78 rules activate with one click.

Rule name	Description	Severity	ATT&CK	Source
Exchange Online Mailbox Forwarding Rule Created to External Address	Auto-forward rule routes all incoming mail to an external email address.	Critical	T1114.003	M365 Audit
Exchange Online eDiscovery Search Run by Non-Compliance User	Cross-mailbox search executed by an account outside the compliance or legal team.	Critical	T1114.002	M365 Audit
Exchange Online Mailbox Delegation Granted to Unusual User	Full mailbox access or send-as permission granted to an unexpected account.	High	T1114.002	M365 Audit
SharePoint Mass File Download — Exfiltration Pattern	User downloads an anomalously high volume of SharePoint files within a short period.	High	T1213.002	M365 Audit
OneDrive Sync Client Enabled for Unmanaged Device	OneDrive sync enabled on a device not enrolled in Intune or Entra join.	Medium	T1537	M365 Audit
Teams External Access Enabled — Federated Domains	Teams federation with external domains enabled org-wide.	Medium	T1048	M365 Audit
M365 Defender Incident — High Severity	Microsoft 365 Defender creates a high-severity correlated incident.	Critical	Various	M365 Defender
Exchange Online Transport Rule Modified to BCC External Address	Mail flow transport rule modified to silently copy email to external recipient.	Critical	T1114.003	M365 Audit
SharePoint Site Collection External Sharing Enabled	SharePoint site external sharing policy relaxed to allow anonymous or external links.	High	T1530	M365 Audit
M365 Admin Role Assigned to Guest Account	Global Admin or sensitive admin role assigned to a B2B guest user account.	Critical	T1098.003	M365 Audit
M365 Compliance — DLP Policy Disabled	Data Loss Prevention policy disabled — reduces data exfiltration controls.	High	T1562.001	M365 Audit
Exchange Online OWA Enabled for All Users After Being Disabled	Outlook on the Web access re-enabled — potential phishing or access control bypass.	High	T1078	M365 Audit
M365 Unified Audit Log Disabled	Unified Audit Log disabled — removes visibility into all M365 user activity.	Critical	T1562.008	M365 Audit
Exchange Online Phishing Campaign Flagged by Defender	Defender for Office 365 identifies a phishing campaign targeting multiple users.	High	T1566.001	M365 Defender
SharePoint Search API — Bulk Document Access Pattern	SharePoint search API used to enumerate and access documents at volume.	High	T1213.002	M365 Audit
Exchange Online Safe Links Policy Disabled	Safe Links URL rewriting disabled — reduces phishing link protection.	High	T1562.001	M365 Audit
Teams Guest Access Enabled Without MFA Requirement	Teams guest access allowed for accounts not subject to MFA CA policy.	Medium	T1078	M365 Audit
M365 Power Automate Flow Created to Export Data	Power Automate flow created that routes SharePoint or Exchange data to external service.	High	T1537	M365 Audit
Exchange Online Anti-Spam Policy Modified	Anti-spam or anti-malware policy disabled or threshold increased.	Medium	T1562.001	M365 Audit
M365 Conditional Access Policy Exclusion Added	Named user or group added to CA policy exclusion — may remove MFA requirement.	High	T1548	M365 Audit

Prerequisites

Entra ID app registration with Office 365 Management APIs ActivityFeed.Read permission (application permission)
M365 Unified Audit Log enabled (Admin Center > Compliance > Audit) — disabled by default in new tenants
Microsoft 365 Defender API access for incident ingestion (securityAlerts.Read.All and ThreatHunting.Read.All)
Exchange Online audit logging enabled per mailbox (Set-Mailbox -AuditEnabled $true) for mailbox-level events

Microsoft 365 Detection Pack: frequently asked questions

What M365 services does this detection pack cover?

The M365 detection pack covers Exchange Online (mail flow, forwarding, delegation), SharePoint Online (file access, external sharing, search API), OneDrive for Business (sync, sharing, downloads), Microsoft Teams (external federation, guest access, file sharing), Microsoft 365 Defender incidents, and the M365 Unified Audit Log. ManySignal connects via the Office 365 Management Activity API.

How does ManySignal ingest M365 audit logs?

ManySignal connects to the Office 365 Management Activity API using an Entra ID app registration with ActivityFeed.Read permission. Subscriptions are created for Audit.General, Audit.Exchange, Audit.SharePoint, and Audit.AzureActiveDirectory content types. ManySignal polls for new events at configurable intervals down to one minute.

Can ManySignal detect Business Email Compromise (BEC) patterns?

Yes. BEC detection covers the full attack chain: phishing delivery (Defender for Office 365 alerts), account compromise (Entra ID sign-in anomalies), mailbox forwarding rule creation (Exchange audit), eDiscovery abuse (compliance audit), and financial document access in SharePoint or OneDrive. Cross-product correlation is ManySignal's key advantage for BEC.

How does the pack handle Microsoft 365 Defender integration?

Microsoft 365 Defender incidents are ingested via the Defender API (securityAlerts.Read.All permission). Defender incidents are correlated with raw audit log events — a Defender phishing incident is enriched with the affected user's recent SharePoint download history, mailbox delegation changes, and sign-in anomalies.

Does this pack work with Microsoft 365 GCC High or DoD?

ManySignal supports Microsoft 365 Commercial, GCC, and GCC High endpoints. The Office 365 Management Activity API base URL and Entra ID authentication endpoints are configurable per environment. GCC High and DoD tenants require separate app registrations in the respective sovereign clouds.

Full Microsoft 365 threat coverage from Exchange to SharePoint

78 detection rules covering the complete M365 estate — from BEC forwarding rules to SharePoint mass download and M365 Defender correlation.

Book a demo Explore the platform