Obsidian Sandstorm - Internal Lateral Phishing from Compromised Mailbox

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•12

This rule monitors for potential lateral phishing activity within an organization by identifying internal accounts sending high volumes of emails, correlating this with MailItemsAccessed audit events from unexpected IPs, and detecting OAuth token abuse patterns (such as granting consent or adding credentials) within the Exchange Online environment.