High-volume Exchange Online REST API access via One Outlook Web
This rule detects high-volume interactions with the Exchange Online REST API originated from the 'One Outlook Web' application ID, specifically filtering for events with associated token IDs. This pattern may indicate automated mailbox data exfiltration or unauthorized bulk email access, which has been observed in recent phishing-based identity compromise campaigns.
Sigma
