Mass Email Deletion by Single User in short period of time
Detects when a single user deletes more than 25 emails within a 2-minute window. This behavior may indicate a compromised account, insider threat activity, data destruction attempt, or automated malicious script. The detection monitors Exchange operations including MoveToDeletedItems, SoftDelete, and HardDelete actions.
Microsoft Sentinel (KQL)
