Skip to content

Commit 3bd9ab8

Browse files
terrancedejesusterrancedejesus
authored
[New Rule] Excessive Microsoft 365 Mailbox Items Accessed (#4825)
* new rule Excessive Microsoft 365 Mailbox Items Accessed * bumping patch version
1 parent b0ca026 commit 3bd9ab8

File tree

3 files changed

+150
-2
lines changed

3 files changed

+150
-2
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,9 @@
198198
},
199199
"logs-o365.audit-*": {
200200
"o365.audit.ExtendedProperties.ResultStatusDetail": "keyword",
201-
"o365.audit.OperationProperties.Value": "keyword"
201+
"o365.audit.OperationProperties.Name": "keyword",
202+
"o365.audit.OperationProperties.Value": "keyword",
203+
"o365.audit.OperationCount": "long"
202204
},
203205
"logs-okta*": {
204206
"okta.debug_context.debug_data.flattened.requestedScopes": "keyword",

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[project]
22
name = "detection_rules"
3-
version = "1.2.24"
3+
version = "1.2.25"
44
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
55
readme = "README.md"
66
requires-python = ">=3.12"

‎rules/integrations/o365/collection_microsoft_365_excessive_mail_items_accessed.toml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
[metadata]
2+
creation_date = "2025/06/17"
3+
integration = ["o365"]
4+
maturity = "production"
5+
updated_date = "2025/06/17"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies an excessive number of Microsoft 365 mailbox items accessed by a user either via aggregated counts or
11+
throttling. Microsoft audits mailbox access via the MailItemsAccessed event, which is triggered when a user accesses
12+
mailbox items. If more than 1000 mailbox items are accessed within a 24-hour period, it is then throttled. Excessive
13+
mailbox access may indicate an adversary attempting to exfiltrate sensitive information or perform reconnaissance on a
14+
target's mailbox. This rule detects both the throttled and unthrottled events with a high threshold.
15+
"""
16+
false_positives = [
17+
"""
18+
Legitimate users may access a large number of mailbox items in a short period, especially in environments with high
19+
email volume or during data migrations. If this is expected behavior, consider adjusting the rule or adding
20+
exceptions for specific users or groups.
21+
""",
22+
]
23+
from = "now-9m"
24+
index = ["filebeat-*", "logs-o365.audit-*"]
25+
language = "kuery"
26+
license = "Elastic License v2"
27+
name = "Excessive Microsoft 365 Mailbox Items Accessed"
28+
note = """## Triage and analysis
29+
30+
### Investigating Excessive Microsoft 365 Mailbox Items Accessed
31+
32+
Identifies an excessive number of Microsoft 365 mailbox items accessed by a user either via aggregated counts or throttling. Microsoft audits mailbox access via the MailItemsAccessed event, which is triggered when a user accesses mailbox items. If more than 1000 mailbox items are accessed within a 24-hour period, it is then throttled. Excessive mailbox access may indicate an adversary attempting to exfiltrate sensitive information or perform reconnaissance on a target's mailbox. This rule detects both the throttled and unthrottled events with a high threshold.
33+
34+
### Possible investigation steps
35+
- Review `host.name` to identify the tenant where the mailbox access occurred.
36+
- Review `o365.audit.UserId` or `o365.audit.MailboxOwnerUPN` to identify the user associated with the mailbox access.
37+
- Examine `o365.audit.ExternalAccess` to determine if the mailbox access was performed by an external user or application.
38+
- Check the geolocation data to identify the location from which the mailbox access occurred. Is this an expected location for the user?
39+
- Check `o365.audit.ClientAppId` to identify the application used for mailbox access. Look for any unusual or unexpected applications but be aware that some legitimate applications may also trigger this rule if OAuth phishing was used.
40+
- Review `o365.audit.Folders.Path` and `o365.audit.Folders.FolderItems.Id` to identify the specific folders and items accessed within the mailbox. Look for any sensitive or high-value folders that may indicate targeted access.
41+
- For specific items accessed, examine `o365.audit.Folders.FolderItems.Id` to gather more context on the accessed mailbox items.
42+
- User types can be identified by checking `o365.audit.UserType`. Review if the mailbox of the user is a member, admin or delegate.
43+
- If Entra ID logs are available, checking the risk status via `azure.signinlogs.properties.risk_state` and `azure.signinlogs.properties.risk_level` can provide additional context on the user's risk status during the mailbox access.
44+
45+
### False positive analysis
46+
- Legitimate users may access a large number of mailbox items in a short period, especially in environments with high email volume or during data migrations. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users or groups.
47+
- Automated processes or scripts that access mailbox items may also trigger this rule. If these processes are legitimate and necessary, consider adding exceptions for the specific applications or users involved.
48+
- Users with high email activity, such as helpdesk or support roles, may trigger this rule due to their job responsibilities. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users or groups.
49+
50+
### Response and remediation
51+
- Investigate the user account associated with the excessive mailbox access to determine if it has been compromised or if the activity is expected behavior.
52+
- If the mailbox access is confirmed to be suspicious or unauthorized, take immediate action to revoke the access token and prevent further access.
53+
- Disable the user account temporarily to prevent any potential compromise or unauthorized access.
54+
- Review the user's recent sign-in activity and access patterns to identify any potential compromise or unauthorized access.
55+
- If the user account is compromised, initiate a password reset and enforce multi-factor authentication (MFA) for the user.
56+
- Review the conditional access policies in place to ensure they are sufficient to prevent unauthorized access to sensitive resources.
57+
- Examine how the mailbox access was performed. If it was done via a third-party application, review the permissions granted to that application and consider revoking them if they are not necessary.
58+
"""
59+
references = [
60+
"https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts#use-mailitemsaccessed-audit-records-for-forensic-investigations",
61+
"https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/",
62+
]
63+
risk_score = 47
64+
rule_id = "7fc95782-4bd1-11f0-9838-f661ea17fbcd"
65+
severity = "medium"
66+
tags = [
67+
"Domain: Cloud",
68+
"Domain: Email",
69+
"Data Source: Microsoft 365",
70+
"Data Source: Microsoft 365 Audit Logs",
71+
"Use Case: Threat Detection",
72+
"Tactic: Collection",
73+
"Resources: Investigation Guide",
74+
]
75+
timestamp_override = "event.ingested"
76+
type = "query"
77+
78+
query = '''
79+
event.dataset: "o365.audit" and
80+
event.provider: "Exchange" and
81+
event.action: "MailItemsAccessed" and
82+
event.code: "ExchangeItemAggregated" and
83+
(
84+
(
85+
o365.audit.OperationProperties.Name: "IsThrottled" and
86+
o365.audit.OperationProperties.Value: "True"
87+
) or o365.audit.OperationCount >= 100
88+
)
89+
'''
90+
91+
92+
[[rule.threat]]
93+
framework = "MITRE ATT&CK"
94+
[[rule.threat.technique]]
95+
id = "T1114"
96+
name = "Email Collection"
97+
reference = "https://attack.mitre.org/techniques/T1114/"
98+
[[rule.threat.technique.subtechnique]]
99+
id = "T1114.002"
100+
name = "Remote Email Collection"
101+
reference = "https://attack.mitre.org/techniques/T1114/002/"
102+
103+
104+
105+
[rule.threat.tactic]
106+
id = "TA0009"
107+
name = "Collection"
108+
reference = "https://attack.mitre.org/tactics/TA0009/"
109+
110+
[rule.investigation_fields]
111+
field_names = [
112+
"user.id",
113+
"user.name",
114+
"user.email",
115+
"user.domain",
116+
"event.id",
117+
"event.action",
118+
"event.outcome",
119+
"event.provider",
120+
"source.ip",
121+
"related.ip",
122+
"related.user",
123+
"o365.audit.ClientAppId",
124+
"o365.audit.AppId",
125+
"o365.audit.AppAccessContext.UniqueTokenId",
126+
"o365.audit.OperationCount",
127+
"o365.audit.MailboxOwnerUPN",
128+
"o365.audit.MailboxOwnerSid",
129+
"o365.audit.MailboxGuid",
130+
"o365.audit.UserKey",
131+
"o365.audit.LogonUserSid",
132+
"o365.audit.TokenTenantId",
133+
"o365.audit.OriginatingServer",
134+
"o365.audit.ClientInfoString",
135+
"o365.audit.CreationTime",
136+
"o365.audit.ResultStatus",
137+
"source.geo.country_iso_code",
138+
"source.geo.country_name",
139+
"source.geo.continent_name",
140+
"source.geo.location",
141+
"cloud.account.id",
142+
"cloud.provider",
143+
"cloud.region",
144+
"cloud.service.name",
145+
]
146+

0 commit comments

Comments
 (0)