2026 Critical Enterprise Intrusion Chain Detection: Anomalous Mailbox Access Spike by Non-Owner Session
Detects high-volume mailbox item access (MailItemsAccessed) within 15-minute intervals, correlated with risky Entra ID sign-in events within a 60-minute window. This behavior is indicative of automated mail reconnaissance or data exfiltration following potential cloud account compromise.
Microsoft Sentinel (KQL)
