← Back to SOC feed Coverage →

OAuth Apps accessing user mail via GraphAPI [Nobelium]

kql MEDIUM Azure-Sentinel
CloudAppEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-21T11:00:00Z · Confidence: medium

Hunt Hypothesis

OAuth applications accessing user mail via GraphAPI may indicate unauthorized access or data exfiltration by adversaries leveraging compromised credentials. SOC teams should proactively hunt for this behavior to identify potential Nobelium-style attacks that exploit OAuth integrations to access sensitive email data.

KQL Query

CloudAppEvents 
| where Timestamp >= ago(1h) 
| where ActionType == "MailItemsAccessed" 
| where RawEventData has "00000003-0000-0000-c000-000000000000" // performance 
| where RawEventData has "ClientAppId" 
| extend rawData = parse_json(RawEventData) 
| extend AppId = tostring(parse_json(rawData.AppId)) 
| where AppId == "00000003-0000-0000-c000-000000000000"         // graph API 
| extend OAuthAppId = tostring(parse_json(rawData.ClientAppId)) // extract OAuthAppId 
| summarize by OAuthAppId

Analytic Rule Definition

id: 19cbed50-3554-44ed-b8de-90f275b69c8a
name: OAuth Apps accessing user mail via GraphAPI [Nobelium]
description: |
  This query helps you review all OAuth applications accessing user mail via Graph. It could return a significant number of results depending on how many applications are deployed in the environment.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Exfiltration
tags:
- Nobelium
query: |
  CloudAppEvents 
  | where Timestamp >= ago(1h) 
  | where ActionType == "MailItemsAccessed" 
  | where RawEventData has "00000003-0000-0000-c000-000000000000" // performance 
  | where RawEventData has "ClientAppId" 
  | extend rawData = parse_json(RawEventData) 
  | extend AppId = tostring(parse_json(rawData.AppId)) 
  | where AppId == "00000003-0000-0000-c000-000000000000"         // graph API 
  | extend OAuthAppId = tostring(parse_json(rawData.ClientAppId)) // extract OAuthAppId 
  | summarize by OAuthAppId

Required Data Sources

Sentinel TableNotes
CloudAppEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Exfiltration/OAuth Apps accessing user mail via GraphAPI [Nobelium].yaml