Microsoft 365 mailbox access burst
A burst of Microsoft 365 mailbox-item access (MailItemsAccessed / AttachmentAccess) against one mailbox from one client IP in a short window.
What it detects
A burst of Microsoft 365 mailbox-item access (MailItemsAccessed / AttachmentAccess) against one mailbox from one client IP in a short window. After account takeover, attackers harvest a mailbox — reading and downloading many messages and attachments programmatically — which shows up as a dense run of access events from a single, often unfamiliar, source IP. Grouped by mailbox + client IP so ordinary interactive use does not trip it, while automated collection stands out.
MITRE ATT&CK mapping
- T1114.002Email Collection: Remote Email Collection· Collection
False positives and triage
Heavy Outlook/OWA sync, migrations, journaling, and e-discovery can generate many MailItemsAccessed events legitimately. The signal is a large burst from a single client IP — especially one that is new for this mailbox or geographically implausible — correlated with a suspicious sign-in or a new inbox rule. Confirm the source IP and the account owner before escalating.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_mailbox_access_burst.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mailbox_access_burst
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1114.002]
description: |
A burst of Microsoft 365 mailbox-item access (MailItemsAccessed /
AttachmentAccess) against one mailbox from one client IP in a short window.
After account takeover, attackers harvest a mailbox — reading and downloading
many messages and attachments programmatically — which shows up as a dense run
of access events from a single, often unfamiliar, source IP. Grouped by
mailbox + client IP so ordinary interactive use does not trip it, while
automated collection stands out.
match:
provider: Office365
event_action_any:
- MailItemsAccessed
- AttachmentAccess
threshold:
count: 40
window_seconds: 600
group_by: [user_name, source_ip]
correlation_keys: [user_name, source_ip]
false_positive_guidance: |
Heavy Outlook/OWA sync, migrations, journaling, and e-discovery can generate
many MailItemsAccessed events legitimately. The signal is a large burst from a
single client IP — especially one that is new for this mailbox or geographically
implausible — correlated with a suspicious sign-in or a new inbox rule. Confirm
the source IP and the account owner before escalating.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.