[New Rule] Excessive Microsoft 365 Mailbox Items Accessed

[terrancedejesus]

Description

Microsoft adds an audit event MailItemsAccessed in M365 audit logs that records when items are accessed from a mailbox. This was added to enable analysts to investigate account takeovers (ATO) and mailbox access. They aggregate the count for mailbox items accessed and provide o365.audit.OperationCount to record this. If >1000 MailItemsAccessed are recorded for a user in 24 hours, then the mailbox is throttled, with the IsThrottled status. They document that <1% of all EXO mailboxes are throttled, making this a plausible signal. Excessive mailbox access is also a common task by adversaries such as Void Blizzard or UTA0352.

Target Ruleset

o365

Target Rule Type

Custom (KQL or Lucene)

Tested ECS Version

No response

Query

event.dataset: "o365.audit" and
    event.provider: "Exchange" and
    event.action: "MailItemsAccessed" and
    event.code: "ExchangeItemAggregated" and
    (
        (
            o365.audit.OperationProperties.Name: "IsThrottled" and
            o365.audit.OperationProperties.Value: "True"
        ) or o365.audit.OperationCount >= 100
    )

New fields required in ECS/data sources for this rule?

No response

Related issues or PRs

• https://github.com/elastic/ia-trade-team/issues/642

References

No response

Redacted Example Data

No response