Exchange Outbound External Mail Volume Spike From Single Sender

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects an unusual volume of externally directed mail from one sender. Mail is a high-capacity exfiltration channel that is permitted by default, and a compromised mailbox sending outward in bulk is both data loss and, where the content is phishing, damage to the organisation's sending reputation. Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_SENT_EXTERNAL' | duration 1h | groupby sender | select sender, count(*) as cnt | having cnt > 100