Microsoft 365 DLP policy disabled or removed

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Office 365 Audit
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses (T1562) Impair Defenses: Disable or Modify Tools (T1562.001)
Severity	Informational

A user disabled or removed a Microsoft 365 data loss prevention (DLP) policy, which may indicate DLP monitoring evasion.

An attacker is attempting to bypass Microsoft 365 Data Loss Prevention (DLP) policies.

Follow further actions done by the account.
Verify that the configuration change was expected.
Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Monitor the user's activity for any access to sensitive data or data exfiltration.
Investigate if any other security policies have been changed or removed.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A user disabled or removed a Microsoft 365 data loss prevention (DLP) policy, which may indicate DLP monitoring evasion.

An attacker is attempting to bypass Microsoft 365 Data Loss Prevention (DLP) policies.

Follow further actions done by the account.
Verify that the configuration change was expected.
Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Monitor the user's activity for any access to sensitive data or data exfiltration.
Investigate if any other security policies have been changed or removed.