Multiple Mailbox Permission Removals in Exchange

Ankit Mehta@Secvyn

•updated Jun 13, 2026•1•0•3

This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.