User moved Exchange sent messages to deleted items

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	Office 365 Audit
Detection Modules	Identity Threat Module, SaaS Threat Detection, Email
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Indicator Removal: Clear Mailbox Data (T1070.008)
Severity	Informational

Description

A user moved sent messages to deleted items in Exchange.

Attacker's Goals

An attacker is attempting to hide newly sent email messages for evasion purposes.

Investigative actions

• Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
• Investigate the IP address associated with the activity.
• Follow further actions done by the account.
• Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
• Examine the user's email activity history for suspicious behavior.

Variations

Sensitive Exchange sent messages moved to deleted items from unusual source

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Indicator Removal: Clear Mailbox Data (T1070.008)
Severity	Low

Description

A user moved sensitive sent messages to deleted items in Exchange.

Attacker's Goals

An attacker is attempting to hide newly sent email messages for evasion purposes.

Investigative actions

• Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
• Investigate the IP address associated with the activity.
• Follow further actions done by the account.
• Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
• Examine the user's email activity history for suspicious behavior.