ARToken BEC Mailbox Recon: High-Frequency Graph Mail Search for Financial Keywor

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

This rule detects anomalous high-frequency search activity within Microsoft 365 environments targeting sensitive keyword terms like 'invoice', 'payment', 'wire', or 'bank.details'. The detection identifies users performing multiple searches across mailbox or graph activity within a short period, which may indicate account compromise or unauthorized email exfiltration attempts.