Microsoft 365 mailbox bulk sync
A burst of folder-level mailbox syncs (MailItemsAccessed with MailAccessType=Sync) from one client.
What it detects
A burst of folder-level mailbox syncs (MailItemsAccessed with MailAccessType=Sync) from one client. A Sync pulls a whole folder's messages at once — far heavier than a single-message Bind — so a run of Syncs is the shape of wholesale mailbox harvesting after account takeover, especially from an unfamiliar client or IP.
MITRE ATT&CK mapping
- T1114.002Email Collection: Remote Email Collection· Collection
False positives and triage
A newly configured Outlook/mobile client syncs many folders legitimately. The signal is repeated Syncs from an unfamiliar client IP, over a legacy protocol, or correlated with a suspicious sign-in / new inbox rule.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_mailbox_bulk_sync.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mailbox_bulk_sync
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1114.002]
description: |
A burst of folder-level mailbox syncs (MailItemsAccessed with
MailAccessType=Sync) from one client. A Sync pulls a whole folder's messages at
once — far heavier than a single-message Bind — so a run of Syncs is the shape of
wholesale mailbox harvesting after account takeover, especially from an
unfamiliar client or IP.
match:
provider: Office365
event_action: MailItemsAccessed
raw_message_contains_any:
- "MailAccessType=Sync"
threshold:
count: 10
window_seconds: 600
group_by: [user_name, source_ip]
correlation_keys: [user_name, source_ip]
false_positive_guidance: |
A newly configured Outlook/mobile client syncs many folders legitimately. The
signal is repeated Syncs from an unfamiliar client IP, over a legacy protocol, or
correlated with a suspicious sign-in / new inbox rule.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.