User mail items accessed from multiple IPs in the same subnet

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Office 365 Audit
Detection Modules	Identity Threat Module
Detector Tags	Extortion
ATT&CK Tactic	Collection (TA0009), Command and Control (TA0011)
ATT&CK Technique	Email Collection: Remote Email Collection (T1114.002), Proxy: Multi-hop Proxy (T1090.003)
Severity	Informational

Description

A user's Exchange mailbox was accessed from multiple distinct caller IPs that all reside in the same /16 subnet within a short time window. This pattern is characteristic of VPS abuse and IP rotation designed to evade per-IP velocity controls.

Attacker's Goals

An adversary may access user mail items from multiple IP addresses within the same subnet, which can aid in evading per-IP rate limits and avoiding detection while maintaining persistent access to a compromised mailbox.

Investigative actions

• Enumerate every caller IP in the subnet that accessed the user's mailbox in the past 24h and check their SPUR/threat-intel reputation.

• Inspect the user's sessions: look for new OAuth grants, new inbox rules, MFA changes and revoke active sessions.

• Correlate the subnet/ASN with other tenant users to determine the scope.

Variations

User mail items accessed from rotating IPs in same subnet with anomalous properties

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009), Command and Control (TA0011)
ATT&CK Technique	Email Collection: Remote Email Collection (T1114.002), Proxy: Multi-hop Proxy (T1090.003)
Severity	Low

Description

A user's mailbox was accessed from multiple rotating IPs in the same /16 subnet, and at least one IP address contributed additional anomaly signals (e.g., unmanaged or risky caller IP, anomalous country or ASN for this user).

Attacker's Goals

An adversary may access user mail items from multiple IP addresses within the same subnet, which can aid in evading per-IP rate limits and avoiding detection while maintaining persistent access to a compromised mailbox.

Investigative actions

• Enumerate every caller IP in the subnet that accessed the user's mailbox in the past 24h and check their SPUR/threat-intel reputation.

• Inspect the user's sessions: look for new OAuth grants, new inbox rules, MFA changes and revoke active sessions.

• Correlate the subnet/ASN with other tenant users to determine the scope.