Multiple mail items were accessed in a short period of time

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Office 365 Audit
Detection Modules	Identity Threat Module, Email
Detector Tags	Extortion
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Email Collection: Remote Email Collection (T1114.002)
Severity	Informational

Description

A single caller IP read mail items from a single mailbox an unusually high number of times within a short time window.

Attacker's Goals

An adversary may rapidly access multiple mail items within a short period of time, which can aid in the bulk exfiltration of sensitive email content from a compromised mailbox.

Investigative actions

• Review the sessions originated from the caller IP address.
• Inspect the user for fresh OAuth grants, new inbox rules, MFA enrolment changes and anomalous logins.
• Check the IP reputation and revoke active sessions for the user.

Variations

Multiple mail items were accessed in a short period of time with anomalous properties

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Email Collection: Remote Email Collection (T1114.002)
Severity	Low

Description

A single caller IP read mail items from a single mailbox at an unusually high rate, and the IP address contributed additional anomaly signals (e.g., unmanaged or risky caller IP, anomalous country or ASN for this user).

Attacker's Goals

An adversary may rapidly access multiple mail items within a short period of time, which can aid in the bulk exfiltration of sensitive email content from a compromised mailbox.

Investigative actions

• Review the sessions originated from the caller IP address.
• Inspect the user for fresh OAuth grants, new inbox rules, MFA enrolment changes and anomalous logins.
• Check the IP reputation and revoke active sessions for the user.