[New Rule] Threat Intelligence Signal - Microsoft Defender for Office 365

rules/integrations/o365/initial_access_defender_for_m365_threat_intelligence_signal.toml

@@ -0,0 +1,62 @@
+[metadata]
+creation_date = "2025/08/19"
+integration = ["o365"]
+maturity = "production"
+promotion = true
+updated_date = "2025/08/19"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies a Microsoft 365 audit log generated for Threat Intelligence signals by Microsoft Defender for Office 365.
+Signals generated may relate to services such as Exchange Online, SharePoint Online, OneDrive for Business and others.
+"""
+false_positives = [
+    """
+    Signals are generated by Microsoft Defender for Office 365. False-positives may occur if legitimate user activity is
+    misclassified as a threat.
+    """,
+]
+from = "now-9m"
+index = ["filebeat-*", "logs-o365.audit-*"]
+language = "kuery"
+license = "Elastic License v2"
+max_signals = 1000
+name = "Threat Intelligence Signal - Microsoft Defender for Office 365"
+note = "For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).\n"
+references = [
+    "https://learn.microsoft.com/en-us/purview/audit-supported-services",
+    "https://www.octiga.io/en-gb/insights/nist-csf-for-office-365",
+    "https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema",
+]
+risk_score = 47
+rule_id = "60c814fc-7d06-11f0-b326-f661ea17fbcd"
+severity = "medium"
+tags = [
+    "Domain: Cloud",
+    "Domain: SaaS",
+    "Data Source: Microsoft 365",
+    "Data Source: Microsoft 365 Audit Logs",
+    "Use Case: Threat Detection",
+]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset: "o365.audit" and event.code: "ThreatIntelligence"
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+
+
+[rule.threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+