Microsoft 365 eDiscovery search export downloaded

microsoft-365

Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a user downloaded the results of a content search to their local computer.

Strategy

Monitor Microsoft 365 audit logs to look for the operation SearchExportDownloaded. The Content Search eDiscovery feature in the Microsoft 365 Compliance portal allows users to search for email, documents, and instant messaging conversations in collaboration tools such as Microsoft Teams and Microsoft 365 Groups.

Triage and response

  1. Inspect the @Query field to determine if the search criteria warrants further investigation.
  2. Determine if there is a legitimate use case for the export of the content search results by contacting the user {{@usr.email}}.
  3. If {{@usr.email}} is not aware of the download:
    • Investigate other activities performed by the user {{@usr.email}} using the Cloud SIEM - User Investigation dashboard.
    • Begin your organization’s incident response process and investigate.