High-volume mailbox access (MailItemsAccessed/AttachmentAccessed) exfiltration

Ankit Mehta@Secvyn

•updated Sep 10, 2026•1•0•1

Detects anomalous, high-volume access to email items or attachments in Microsoft Exchange Online by a single account from a single IP address, which may indicate account compromise, unauthorized mail harvesting, or data exfiltration.