Suspicious eDiscovery Search or Mailbox Export Activity (M365)

Ali AlEnezi@site

•updated Sep 15, 2026•8•0•2

This rule detects potentially unauthorized mailbox content exports within Microsoft 365, including the creation of mailbox export requests, PST-related compliance searches, and the downloading of exported search results. These activities are common precursors to data exfiltration.