Domain: Email

M365 Azure Monitor Alert Email with Financial or Billing Theme

Mar 26, 2026 · Domain: Cloud Domain: Email Data Source: Microsoft 365 Data Source: Microsoft Exchange Online Message Trace Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide ·

Share on:

Detects Azure Monitor alert notification emails with financial or billing themed subject lines delivered to organization users. Adversaries abuse Azure Monitor alert rules to deliver callback phishing emails from Microsoft's legitimate azure-noreply@microsoft.com address. Because the emails originate from Microsoft's own infrastructure, they pass SPF, DKIM, and DMARC checks, bypassing email security filters and increasing victim trust. The attacker embeds a fraudulent billing or security lure in the alert rule description, which is rendered in the notification email body. Observed subject patterns include invoice numbers, payment references, and order confirmations.

M365 Exchange Inbox Forwarding Rule Created

Mar 23, 2026 · Domain: Cloud Domain: SaaS Domain: Email Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Configuration Audit Tactic: Collection Resources: Investigation Guide ·

Share on:

Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges.

Microsoft Graph Request Email Access by Unusual User and Client

Mar 23, 2026 · Domain: Cloud Domain: Email Data Source: Azure Data Source: Microsoft Graph Data Source: Microsoft Graph Activity Logs Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide ·

Share on:

Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days.

M365 Exchange Inbox Phishing Evasion Rule Created

Feb 5, 2026 · Domain: Cloud Domain: SaaS Domain: Email Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Identifies when a user creates a new inbox rule in Microsoft 365 that deletes or moves emails containing suspicious keywords. Adversaries who have compromised accounts often create inbox rules to hide alerts, security notifications, or other sensitive messages by automatically deleting them or moving them to obscure folders. Common destinations include Deleted Items, Junk Email, RSS Feeds, and RSS Subscriptions. This is a New Terms rule that triggers only when the user principal name and associated source IP address have not been observed performing this activity in the past 14 days.

M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs

Jan 12, 2026 · Domain: Cloud Domain: Email Domain: Identity Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Identity and Access Audit Use Case: Threat Detection Resources: Investigation Guide Tactic: Defense Evasion ·

Share on:

Identifies sign-ins on behalf of a principal user to the Microsoft Graph or legacy Azure AD API from multiple IPs using first-party Microsoft applications from the FOCI (Family of Client IDs) group. Developer tools like Azure CLI, VSCode, and Azure PowerShell accessing these resources from multiple IPs are flagged, along with any FOCI application accessing the deprecated Windows Azure Active Directory from multiple IPs. This behavior may indicate an adversary using a phished OAuth authorization code or refresh token, as seen in attacks like ConsentFix where attackers steal localhost OAuth codes and replay them from attacker infrastructure.

Elastic Defend and Email Alerts Correlation

Dec 15, 2025 · Use Case: Threat Detection Rule Type: Higher-Order Rule Resources: Investigation Guide Data Source: Elastic Defend Data Source: Check Point Harmony Email & Collaboration Domain: Email Domain: Endpoint ·

Share on:

This rule correlates any Elastic Defend alert with an email security related alert by target user name. This may indicate the successful execution of a phishing attack.

M365 Exchange Mailbox Accessed by Unusual Client

Dec 10, 2025 · Domain: Cloud Domain: Email Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide ·

Share on:

Identifies suspicious Microsoft 365 mail access by ClientAppId. This rule detects when a user accesses their mailbox using a client application that is not typically used by the user, which may indicate potential compromise or unauthorized access attempts. Adversaries may use custom or third-party applications to access mailboxes, bypassing standard security controls. First-party Microsoft applications are also abused after OAuth tokens are compromised, allowing adversaries to access mailboxes without raising suspicion.

M365 Exchange Mailbox Items Accessed Excessively

Dec 10, 2025 · Domain: Cloud Domain: Email Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide ·

Share on:

Identifies an excessive number of Microsoft 365 mailbox items accessed by a user either via aggregated counts or throttling. Microsoft audits mailbox access via the MailItemsAccessed event, which is triggered when a user accesses mailbox items. If more than 1000 mailbox items are accessed within a 24-hour period, it is then throttled. Excessive mailbox access may indicate an adversary attempting to exfiltrate sensitive information or perform reconnaissance on a target's mailbox. This rule detects both the throttled and unthrottled events with a high threshold.