M365 Threat Intelligence Signal

Last updated 12 days ago on 2026-02-20

Created 6 months ago on 2025-08-19

About

Identifies Microsoft 365 audit logs generated for Threat Intelligence signals by Microsoft Defender for Office 365. This includes phishing and malware events, campaign-related threat detections, file-based threats in SharePoint, OneDrive, and Teams, as well as Microsoft Threat Intelligence Center (MSTIC) signals. These events provide early indicators of compromise attempts and can be correlated with other signals for threat hunting and detection.

Tags

Domain: CloudDomain: SaaSData Source: Microsoft 365Data Source: Microsoft 365 Audit LogsData Source: Microsoft DefenderData Source: Microsoft Defender for Office 365Data Source: Microsoft Threat IntelligenceUse Case: Threat DetectionTactic: Initial AccessTactic: ExecutionRule Type: BBRLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Phishing (T1566)(external, opens in a new tab or window)

Execution (TA0002)(external, opens in a new tab or window)

↳ User Execution (T1204)(external, opens in a new tab or window)

False Positive Examples

Signals are generated by Microsoft Defender for Office 365. False-positives may occur if legitimate user activity is misclassified as a threat.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: filebeat-*logs-o365.audit-*
Related Integrations: o365(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.dataset: "o365.audit" and
    event.code:(ThreatIntelligence or ThreatFinder or ThreatIntelligenceAtpContent or ThreatIntelligenceUrl or MSTIC or Campaign)

Install detection rules in Elastic Security

Detect M365 Threat Intelligence Signal in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).