Mail Quarantine Bulk Spike Correlated with Concurrent Exfiltration or Remote Access

Georgios Maragos@Gmarak

•updated Sep 9, 2026•0•0•3

Detects a significant surge of bulk or spam mail quarantine events for a single mailbox within a 15-minute window. This behavior often indicates a mail-bombing attack intended to overwhelm the user or as a distraction technique (smokescreen) to hide concurrent malicious activities such as exfiltration, lateral movement, or ransomware staging in the M365 tenant.