All Detections

Unusual Exchange Mailbox Access Activity

avatar
Ankit Mehta@Secvyn
updated Jun 30, 2026103

Detects mailbox access events from IP addresses or networks uncommon for the user. Frequently observed after successful token theft.

Microsoft Sentinel (KQL)