Unusual Mailbox or Folder Access in Office 365_V_2
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of distinct mailboxes belonging to other users. 2) Identifies users accessing a high number of distinct folders within another user's mailbox. Both parts are designed to flag potential unauthorized access, data exfiltration, or reconnaissance activities within an Exchange Online environment.
Microsoft Sentinel (KQL)
