Mailbox enumeration activity by Azure application

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: Azure Audit Log OR Microsoft Graph Logs
Detection Modules	Cloud
Detector Tags	Microsoft Graph Activity Logs
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Informational

Description

Microsoft Graph API was used to enumerate mailboxes in Azure tenant.

Attacker's Goals

To extract sensitive information stored in mailboxes.

Investigative actions

• Determine which mailboxes were enumerated and whether they contained any sensitive information.
• Investigate the identity following actions.

Variations

Mailbox enumeration activity by Azure user

Synopsis

Field	Value
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Informational

Description

Microsoft Graph API was used by a user to enumerate mailboxes.

Attacker's Goals

To extract sensitive information stored in mailboxes.

Investigative actions

• Determine which mailboxes were enumerated and whether they contained any sensitive information.
• Investigate the identity following actions.