Microsoft 365 mailbox mass delete
A burst of mailbox message purges (SoftDelete / HardDelete) from one account in a short window.
What it detects
A burst of mailbox message purges (SoftDelete / HardDelete) from one account in a short window. SoftDelete removes messages from Deleted Items and HardDelete purges them so they cannot be recovered — a compromised account deleting its own fraudulent replies to hide a BEC, or an attacker destroying mail as impact. The sample carries hundreds of delete operations, so this is real, observed activity.
MITRE ATT&CK mapping
False positives and triage
Users and retention policies delete mail routinely; MoveToDeletedItems alone is normal. The signal is a BURST of SoftDelete/HardDelete (purges) in minutes, especially from an unfamiliar client IP or right after a new inbox rule / a suspicious sign-in — the shape of an attacker covering their tracks.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_mailbox_mass_delete.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mailbox_mass_delete
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1070.008, T1485]
description: |
A burst of mailbox message purges (SoftDelete / HardDelete) from one account in a
short window. SoftDelete removes messages from Deleted Items and HardDelete purges
them so they cannot be recovered — a compromised account deleting its own
fraudulent replies to hide a BEC, or an attacker destroying mail as impact. The
sample carries hundreds of delete operations, so this is real, observed activity.
match:
provider: Office365
event_action_any:
- SoftDelete
- HardDelete
threshold:
count: 15
window_seconds: 600
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Users and retention policies delete mail routinely; MoveToDeletedItems alone is
normal. The signal is a BURST of SoftDelete/HardDelete (purges) in minutes,
especially from an unfamiliar client IP or right after a new inbox rule / a
suspicious sign-in — the shape of an attacker covering their tracks.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.