Detection reference

Corelog runs 12 heuristics against the loaded audit log. Each is mapped to a MITRE ATT&CK technique, and every threshold, window and baseline is stated below — if a tool flags an event you should be able to explain exactly why to whoever asks. Detections that depend on location resolve the country from the client IP against a database bundled with the app, because Purview’s own GeoLocation field carries a datacenter region rather than a country on most tenants.

Impossible Travel

MITRE: T1078 — Valid Accounts · Severity: High

Fires when two consecutive SIGN-IN events for the same user originate from countries whose geographic centroids are more than 1,000 km apart and are separated by less than 1 hour. The distance is calculated using the Haversine formula against ISO-3166-1 alpha-2 country codes. A single flag is raised on both the earlier and later event. Only interactive authentication counts as evidence of where a person was — UserLoggedIn, UserLoginFailed, SignInEvent, PasswordLogonInitialAuthUsingPassword, TeamsSessionStarted and EmailAuthOTPAuthenticationSucceeded. File and mail operations are excluded because their IP is routinely Microsoft infrastructure acting on the user behalf (background sync, indexing, mobile push), which would otherwise make every mailbox appear to teleport between datacenters. The country is resolved from the client IP against an offline database; Purview GeoLocation field is only used when it genuinely contains a country code, since for SharePoint it carries the multi-geo datacenter region instead. Indicates a credential being used from two physically incompatible locations — typically stolen credentials or a VPN/proxy masking the true origin.

Off-Hours Access

MITRE: T1078.004 — Cloud Accounts · Severity: Medium

Fires on every event whose UTC creation timestamp falls in the window 22:00–06:00. No user baseline is required; the rule is applied uniformly. The window is fixed in UTC to avoid timezone-dependent false negatives in global tenants. Unusually high off-hours activity — especially involving data access or deletion operations — is a common indicator of an attacker operating from a different timezone or an insider threat acting outside monitored hours.

Bulk Operations

MITRE: T1567 / T1485 — Exfiltration Over Web / Data Destruction · Severity: High / Critical

Fires when the same user performs the same operation ≥20 times within a 60-second sliding window. A sliding-window algorithm (two-pointer) is used to avoid O(n²) complexity. If the operation belongs to the Deletion category the flag maps to T1485 (Data Destruction, Critical); otherwise it maps to T1567 (Exfiltration Over Web Service, High). Typical triggers: mass file downloads, bulk deletion of mailbox items, or automated scripts creating many sharing links.

Unmanaged Device

MITRE: T1078 — Valid Accounts · Severity: Medium

Fires when an event with isManagedDevice === false involves a sensitive operation. Sensitive operations are: FileDownloaded, FileSyncDownloadedFull, FileSyncUploadedFull, FileRecycled, FileDeleted, AnonymousLinkCreated, SharingInvitationCreated, CompanyLinkCreated, SharingSet — or any event in the Deletion, Sharing, or Modification category. Unmanaged devices bypass Conditional Access policies and MDM controls, making them a common pivot point for both external attackers and malicious insiders.

New Geography

MITRE: T1078 — Valid Accounts · Severity: Medium

Fires on the first SIGN-IN where a user is seen from a country not previously observed for that user in the dataset. Events are processed in chronological order; the first event from each country establishes the baseline, so only subsequent first-appearances raise a flag. It uses the same evidence rule as Impossible Travel — only interactive authentication events count, because background service access originating in a Microsoft datacenter is not the user appearing in a new country. The country is resolved from the client IP against an offline database. A single new-geography event is low signal on its own; combined with off-hours or bulk-operations flags it is a strong indicator of account compromise.

First-Time Application

MITRE: T1550 — Use Alternate Authentication Material · Severity: Low

Fires the first time a user generates events attributed to an application (appDisplayName or clientAppName) not previously seen for that user in the dataset. Events are processed chronologically. The flag is not raised for the very first application a user uses — only for subsequent new ones. Attacker tooling (e.g. AADInternals, ROADtools) often authenticates as uncommon or undocumented application IDs, making this a useful low-noise signal when combined with other anomalies.

New Device

MITRE: T1078 — Valid Accounts · Severity: Medium

Fires the first time a user generates events from a device identifier (machineId or deviceName) not previously observed for that user in the dataset. Events are processed chronologically. The device is only considered ‘new’ if the user has at least one prior event on a different known device. A new device appearing alongside off-hours or impossible-travel flags strongly suggests account compromise or an attacker operating with cloned credentials on a fresh machine.

External Sharing Burst

MITRE: T1567.002 — Exfiltration to Cloud Storage · Severity: High

Fires when a user creates or modifies ≥5 sharing links or invitations within a 10-minute sliding window. Tracked operations: AnonymousLinkCreated, SharingSet, CompanyLinkCreated, SharingInvitationCreated, AddedToSecureLink. A two-pointer sliding window groups events per user. This pattern is characteristic of pre-exfiltration staging, where an attacker bulk-creates anonymous or guest sharing links to move data out of the tenant without triggering DLP policies designed for direct downloads.

Mailbox Forwarding Rule

MITRE: T1114.003 — Email Forwarding Rule · Severity: Critical

Fires when a New-InboxRule or Set-InboxRule operation is found and the raw AuditData JSON contains any of the following keywords (case-insensitive): forwardto, forwardasattachmentto, redirectto, forwardsmssto. This heuristic detects the creation or modification of inbox rules that silently copy or redirect incoming mail to an external address — a textbook Business Email Compromise (BEC) persistence technique that survives password resets.

Audit Log Tamper

MITRE: T1562.008 — Disable or Modify Cloud Logs · Severity: Critical

Fires when Set-AdminAuditLogConfig, Set-MailboxAuditBypassAssociation, or Set-OrganizationConfig is executed and the raw AuditData JSON contains disable-intent keywords such as UnifiedAuditLogIngestionEnabled, AdminAuditLogEnabledOption, AuditBypass, or JSON fields with enabled: false / adminAuditEnabled: false / mailboxAuditEnabled: false. Disabling audit logging is a defence-evasion technique used by sophisticated attackers to suppress evidence of subsequent actions.

Authentication Anomaly Cluster

MITRE: T1110 — Brute Force · Severity: High

Fires when ≥10 distinct source IP addresses generate authentication events (UserLoggedIn, UserLoginFailed, PasswordLogonInitial) within a 5-minute global sliding window across all users. The window is not user-scoped: it looks at the full tenant. A high count of distinct IPs performing authentication in a short window is the canonical signature of a password-spray attack, where the adversary rotates source IPs to evade per-IP rate limiting.

Unusual Day for User

MITRE: T1078 — Valid Accounts · Severity: Medium / High

Fires when a user’s activity on a given day is far above what that user normally does on that day of the week. The weekly rhythm is learned from the loaded file, per user — nothing assumes when people work, so a tenant running 24/7, Sunday–Thursday, or busiest at weekends is handled identically, and a quiet Thursday in a weekend-heavy business is just as flaggable as a busy Sunday in an office one. Daily counts are compared in log space against the median of that user’s other same-weekday values; the day being tested is always excluded from its own baseline, so a large anomaly cannot inflate the expectation it is measured against. The cut is a robust-statistics constant — Iglewicz-Hoaglin modified z ≥ 3.5, computed against the spread of the loaded dataset itself — rather than a fixed multiplier, which would only ever be right for the organisation it was tuned on. Only upward deviations are reported: a quiet day is not evidence of compromise. A minimum of three observations per weekday per user is required (roughly three weeks of history); with less, the detector reports insufficient history instead of guessing. One flag is raised per anomalous day, not per event, so a single unusual day does not bury the report under its own volume.