Mail item accessed

Hunt Hypothesis

End users accessing a high volume of email items within a short timeframe may indicate reconnaissance or data exfiltration activities. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential insider threats or adversary attempts to gather sensitive information.

KQL Query

CloudAppEvents
| where Timestamp > ago(30d)
| extend Record= (parse_json(RawEventData)).RecordType
| where Record == 50
| take 10

Analytic Rule Definition

id: 81ede5df-2ec3-40a5-9dff-1fe6a841079d
name: Mail item accessed
description: |
  This query helps reviewing emails accessed by end users using cloud app events data
description-detailed: |
  This query helps reviewing emails accessed by end users in their mailboxes using cloud app events data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where Timestamp > ago(30d)
  | extend Record= (parse_json(RawEventData)).RecordType
  | where Record == 50
  | take 10
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/General/Mail item accessed.yaml)

False Positive Guidance

• Scenario: User accesses their own email via the webmail interface
  Filter/Exclusion: Exclude events where the user ID matches the email owner (e.g., user_id = 'user@example.com' or use a field like user_email = email_address)

• Scenario: Scheduled email backup job runs
  Filter/Exclusion: Exclude events with a known job name or task ID (e.g., task_name = 'daily_email_backup' or source = 'backup_service')

• Scenario: Admin accesses user mailbox for support purposes
  Filter/Exclusion: Exclude events where the user is an admin or has elevated privileges (e.g., user_role = 'admin' or user_id IN (admin_user_list))

• Scenario: Email synchronization with an email client (e.g., Outlook, Thunderbird)
  Filter/Exclusion: Exclude events where the source is a known email client (e.g., source_app = 'Outlook' or source_app = 'Thunderbird')

• Scenario: Email forwarding rule triggered by a user
  Filter/Exclusion: Exclude events where the action is a forward and the source is a user (e.g., action = 'forward' AND source_type = 'user')