Microsoft 365 legacy protocol mail access
A mailbox was accessed over a legacy / non-interactive mail protocol — IMAP4, POP3, or Exchange Web Services (EWS).
What it detects
A mailbox was accessed over a legacy / non-interactive mail protocol — IMAP4, POP3, or Exchange Web Services (EWS). These protocols often use basic auth and bypass modern MFA / Conditional Access, so attackers favor them to read and exfiltrate mail from a compromised account with a stolen password. The client is taken from the audit record's ClientInfoString.
MITRE ATT&CK mapping
False positives and triage
Some legitimate mail clients and integrations still use IMAP/POP/EWS. The signal is legacy-protocol access from an unfamiliar IP, for an account that normally uses only modern auth, or correlated with a suspicious sign-in. Confirm whether the account is expected to use that protocol at all.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_legacy_protocol_mail_access.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_legacy_protocol_mail_access
version: 1.1.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1114.002, T1078.004]
description: |
A mailbox was accessed over a legacy / non-interactive mail protocol — IMAP4,
POP3, or Exchange Web Services (EWS). These protocols often use basic auth and
bypass modern MFA / Conditional Access, so attackers favor them to read and
exfiltrate mail from a compromised account with a stolen password. The client is
taken from the audit record's ClientInfoString.
match:
provider: Office365
raw_message_contains_any:
- "Client=IMAP4"
- "Client=IMAP"
- "Client=POP3"
- "Client=POP"
- "Client=EWS"
- "Client=Exchange Web Services"
# Exchange Web Services is what Microsoft actually WRITES for EWS in the
# unified audit log — `Client=WebServices;ExchangeWebServicesProxy/…`. Matching
# only the abbreviation meant every real EWS mailbox read went unseen while the
# rule looked like it covered EWS.
- "Client=WebServices"
- "ExchangeWebServicesProxy"
correlation_keys: [user_name]
false_positive_guidance: |
Some legitimate mail clients and integrations still use IMAP/POP/EWS. The signal
is legacy-protocol access from an unfamiliar IP, for an account that normally
uses only modern auth, or correlated with a suspicious sign-in. Confirm whether
the account is expected to use that protocol at all.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.