Tycoon Session Performs Immediate Mailbox Search

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•6

Detects a newly replayed session issuing mailbox searches for invoice, payment, password, security, or confidential terms. This rule is designed to identify suspicious activity indicative of session hijacking or credential compromise, where an attacker uses a replayed session to search for sensitive information within a mailbox or SharePoint.