O365 Email Send and Hard Delete Suspicious Behavior

This analytic identifies when an O365 email account sends an email and then hard deletes email within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of activity. Threat actors often use this technique to prevent defenders and victims from knowing the account has been compromised.