Microsoft Graph Email Access by Unusual User and Client

  1[metadata]
  2creation_date = "2025/05/06"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/07/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user
 11principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT)
 12to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as
 13/me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal
 14object ID. This is a New Terms rule that only signals if the application ID, user principal object ID, and source ASN have not been
 15seen doing this activity historically.
 16"""
 17from = "now-9m"
 18index = ["logs-azure.graphactivitylogs-*"]
 19language = "kuery"
 20license = "Elastic License v2"
 21name = "Microsoft Graph Email Access by Unusual User and Client"
 22note = """## Triage and analysis
 23
 24### Investigating Microsoft Graph Email Access by Unusual User and Client
 25
 26This rule detects instances where a previously unseen or rare Microsoft Graph application client ID accesses email-related API paths, such as `/v1.0/me/messages`, `/v1.0/me/mailFolders/inbox/messages`, or `/v1.0/users/{id}/messages`. The access is performed with a delegated user token issued to a first-party public client (public client authentication, no client secret), which is the token shape produced by phished OAuth refresh tokens or Primary Refresh Tokens (PRTs). This activity may indicate unauthorized use of a newly consented or compromised application to read or exfiltrate mail content. This is a New Terms rule that only signals if the application ID (`azure.graphactivitylogs.properties.app_id`), user principal object ID (`azure.graphactivitylogs.properties.user_principal_object_id`), and source ASN (`azure.graphactivitylogs.properties.source_asn`) have not been seen doing this activity historically.
 27
 28### Possible Investigation Steps:
 29
 30- `azure.graphactivitylogs.properties.app_id`: Investigate the application ID involved. Is it known and sanctioned in your tenant? Pivot to Azure Portal → Enterprise Applications → Search by App ID to determine app details, publisher, and consent status.
 31- `azure.graphactivitylogs.properties.scopes`: When present, review the delegated scopes on the token. Email-related scopes such as `Mail.ReadWrite` and `Mail.Send` are especially sensitive and confirm the token can interact with mail content.
 32- `url.path`: Determine exactly which mail-related APIs were accessed (e.g., reading inbox, sending messages, enumerating folders).
 33- `user.id`: Identify the user whose credentials were used. Determine if the user recently consented to a new app, clicked a phishing link, or reported suspicious activity.
 34- `user_agent.original`: Check for suspicious automation tools (e.g., `python-requests`, `curl`, non-browser agents), which may suggest scripted access.
 35- `source.ip` and `client.geo`: Investigate the source IP and geography. Look for unusual access from unexpected countries, VPS providers, or anonymizing services.
 36- `http.request.method`: Determine intent based on HTTP method — `GET` (reading), `POST` (sending), `PATCH`/`DELETE` (modifying/removing messages).
 37- `token_issued_at` and `@timestamp`: Determine how long the token has been active and whether access is ongoing or recent.
 38- `azure.graphactivitylogs.properties.c_sid`: Use the session correlation ID to identify other related activity in the same session. This may help identify if the app is accessing multiple users' mailboxes or if the same user is accessing multiple apps.
 39- Correlate with Microsoft Entra ID (`azure.auditlogs` and `azure.signinlogs`) to determine whether:
 40  - The app was recently granted admin or user consent
 41  - Risky sign-ins occurred just prior to or after mail access
 42  - The same IP or app ID appears across multiple users
 43
 44### False Positive Analysis
 45
 46- New legitimate apps may appear after a user consents via OAuth. Developers, third-party tools, or IT-supplied utilities may access mail APIs if users consent.
 47- Users leveraging Microsoft development environments (e.g., Visual Studio Code) may trigger this behavior with delegated `.default` permissions.
 48- Admin-approved apps deployed via conditional access may trigger similar access logs if not previously seen in detection baselines.
 49
 50### Response and Remediation
 51
 52- If access is unauthorized or unexpected:
 53  - Revoke the app's consent in Azure AD via the Enterprise Applications blade.
 54  - Revoke user refresh tokens via Microsoft Entra or PowerShell.
 55  - Investigate the user's session and alert them to possible phishing or OAuth consent abuse.
 56- Review and restrict risky OAuth permissions in Conditional Access and App Governance policies.
 57- Add known, trusted app IDs to a detection allowlist to reduce noise in the future.
 58- Continue monitoring the app ID for additional usage across the tenant or from suspicious IPs.
 59"""
 60references = [
 61    "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
 62    "https://github.com/dirkjanm/ROADtools",
 63    "https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",
 64    "https://pushsecurity.com/blog/consentfix",
 65]
 66risk_score = 47
 67rule_id = "e882e934-2aaa-11f0-8272-f661ea17fbcc"
 68severity = "medium"
 69tags = [
 70    "Domain: Cloud",
 71    "Domain: Email",
 72    "Data Source: Azure",
 73    "Data Source: Microsoft Graph",
 74    "Data Source: Microsoft Graph Activity Logs",
 75    "Use Case: Threat Detection",
 76    "Tactic: Collection",
 77    "Resources: Investigation Guide",
 78]
 79timestamp_override = "event.ingested"
 80type = "new_terms"
 81
 82query = '''
 83data_stream.dataset:azure.graphactivitylogs and
 84    azure.graphactivitylogs.result_signature:200 and
 85    azure.graphactivitylogs.properties.c_idtyp:user and
 86    azure.graphactivitylogs.properties.client_auth_method:0 and
 87    http.request.method:(DELETE or GET or PATCH or POST or PUT) and
 88    url.path:((/beta/me/* or /beta/users/* or /v1.0/me/* or /v1.0/users/*) and (*inbox* or *mail* or *messages*) and not *mailboxSettings*) and
 89    azure.graphactivitylogs.properties.app_id:* and
 90    azure.graphactivitylogs.properties.user_principal_object_id:* and
 91    source.as.number:*
 92'''
 93
 94
 95[[rule.threat]]
 96framework = "MITRE ATT&CK"
 97[[rule.threat.technique]]
 98id = "T1114"
 99name = "Email Collection"
100reference = "https://attack.mitre.org/techniques/T1114/"
101[[rule.threat.technique.subtechnique]]
102id = "T1114.002"
103name = "Remote Email Collection"
104reference = "https://attack.mitre.org/techniques/T1114/002/"
105
106
107
108[rule.threat.tactic]
109id = "TA0009"
110name = "Collection"
111reference = "https://attack.mitre.org/tactics/TA0009/"
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114[[rule.threat.technique]]
115id = "T1550"
116name = "Use Alternate Authentication Material"
117reference = "https://attack.mitre.org/techniques/T1550/"
118[[rule.threat.technique.subtechnique]]
119id = "T1550.001"
120name = "Application Access Token"
121reference = "https://attack.mitre.org/techniques/T1550/001/"
122
123
124
125[rule.threat.tactic]
126id = "TA0005"
127name = "Defense Evasion"
128reference = "https://attack.mitre.org/tactics/TA0005/"
129
130[rule.new_terms]
131field = "new_terms_fields"
132value = [
133    "azure.graphactivitylogs.properties.app_id",
134    "azure.graphactivitylogs.properties.user_principal_object_id",
135    "source.as.number",
136]
137[[rule.new_terms.history_window_start]]
138field = "history_window_start"
139value = "now-7d"