Microsoft 365 send as burst

A RUN of send-as / send-on-behalf activity by one account in a short window — the takeover signal, as opposed to the single delegated send an assistant makes for an executive every day.

This is the escalation half of the pair. A real BEC case produced 466 SendAs events from one compromised mailbox — 81% of that case's entire alert volume — and alerting per message buried the handful of findings that mattered. Burst-detecting the volume and leaving the per-message rule at LOW keeps both readable: the run is ranked, the individual sends stay available as evidence.

• T1114Email Collection· Collection
• T1534Internal Spearphishing· Lateral Movement

A shared or team mailbox with several active delegates can legitimately exceed this in a busy period. Confirm the delegation is expected and review the impersonated mailboxes and subjects; allowlist the mailbox once confirmed rather than raising the threshold globally.

Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_send_as_burst.yaml, licensed under the Apache License 2.0.

id: cloud.identity.m365_send_as_burst
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1114, T1534]
description: |
  A RUN of send-as / send-on-behalf activity by one account in a short window —
  the takeover signal, as opposed to the single delegated send an assistant makes
  for an executive every day.

  This is the escalation half of the pair described in ADR-052. A real BEC case
  produced 466 SendAs events from one compromised mailbox — 81% of that case's
  entire alert volume — and alerting per message buried the handful of findings
  that mattered. Burst-detecting the volume and leaving the per-message rule at
  LOW keeps both readable: the run is ranked, the individual sends stay available
  as evidence.
match:
  provider: Office365
  event_action_any:
    - SendAs
    - SendOnBehalf
threshold:
  count: 3
  window_seconds: 900
  group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
  A shared or team mailbox with several active delegates can legitimately exceed
  this in a busy period. Confirm the delegation is expected and review the
  impersonated mailboxes and subjects; allowlist the mailbox once confirmed rather
  than raising the threshold globally.

• Microsoft 365 mail outbound fanoutSeverity high
• Microsoft 365 send as impersonationSeverity low
• Microsoft 365 AI agent createdSeverity high
• Microsoft 365 app mailbox access manySeverity high
• Microsoft 365 application impersonation grantedSeverity critical
• Microsoft 365 calendar contacts delegatedSeverity high