Microsoft 365 inactive mailbox restored
A soft-deleted or inactive mailbox was restored, or its contents merged into another mailbox.
What it detects
A soft-deleted or inactive mailbox was restored, or its contents merged into another mailbox.
Leavers' mailboxes are retained for compliance and then forgotten. They are also a rich target: years of correspondence, contracts and credentials belonging to someone who is no longer around to notice, and outside the account reviews that cover current staff. Restoring one into an account the attacker already controls moves that history somewhere they can read it, with no mail leaving the tenant.
The technique's tell is the DESTINATION. A restore into the original owner is ordinary recovery; a restore into an unrelated live account is a merge of one person's mail into another's.
MITRE ATT&CK mapping
False positives and triage
Genuine restores happen — an accidental deletion, a legal request for a leaver's mail, a migration rollback — and each has a ticket. Compare the SOURCE mailbox with the TARGET: recovery puts the mail back where it came from, while this technique lands it somewhere else. A target that is a recently active account, a source that belongs to a departed employee, or an actor who is not the mailbox owner and not on the Exchange admin team are each worth pursuing. Also check whether the restored mailbox belonged to someone in finance or leadership, which is who this is usually aimed at.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/m365_inactive_mailbox_restored.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_inactive_mailbox_restored
version: 1.0.0
status: stable
severity: high
confidence: 0.65
platforms: [application]
mitre_techniques: [T1213.002, T1078.004]
description: |
A soft-deleted or inactive mailbox was restored, or its contents merged into
another mailbox.
Leavers' mailboxes are retained for compliance and then forgotten. They are also
a rich target: years of correspondence, contracts and credentials belonging to
someone who is no longer around to notice, and outside the account reviews that
cover current staff. Restoring one into an account the attacker already controls
moves that history somewhere they can read it, with no mail leaving the tenant.
The technique's tell is the DESTINATION. A restore into the original owner is
ordinary recovery; a restore into an unrelated live account is a merge of one
person's mail into another's.
match:
provider: Office365
event_action_any:
- New-MailboxRestoreRequest
- Undo-SoftDeletedMailbox
- Restore-RecoverableItems
- New-MailboxImportRequest
correlation_keys: [user_name, target_user_name]
false_positive_guidance: |
Genuine restores happen — an accidental deletion, a legal request for a leaver's
mail, a migration rollback — and each has a ticket. Compare the SOURCE mailbox
with the TARGET: recovery puts the mail back where it came from, while this
technique lands it somewhere else. A target that is a recently active account, a
source that belongs to a departed employee, or an actor who is not the mailbox
owner and not on the Exchange admin team are each worth pursuing. Also check
whether the restored mailbox belonged to someone in finance or leadership, which
is who this is usually aimed at.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.