Elastic medium stable kql

Deprecated - M365 Security Compliance Unusual Volume of File Deletion

Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security.

View Source

Detection Logic

data_stream.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"Unusual volume of file deletion" and event.outcome:success

False Positives

  • ⚠ Users or System Administrator cleaning out folders.

Field Validations

Loading…

Comments (0)

Loading comments...