High-Volume Exchange Online REST API Access Indicating Email Exfiltration

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects anomalous, high-volume access to Exchange Online via the REST API, potentially indicating programmatic exfiltration of email content. This rule monitors for specific suspicious Application IDs, Account Display Names, or Account Object IDs that exceed a threshold of 500 Exchange REST events, which is characteristic of mass-email collection patterns often seen in cloud-based identity compromises.