• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Anomaly of MailItemAccess by Other Users Mailbox [Nobelium]

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•42

    This query looks for users accessing multiple other users' mailboxes, or accessing multiple folders in another user's mailbox. This query is inspired by an Azure Sentinel detection. Reference - https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/OfficeActivity/AnomolousUserAccessingOtherUsersMailbox.yaml

    Microsoft Sentinel (KQL)

    Tags

    TA0009 - CollectionT1114 - Email CollectionT1114.002 - Remote Email CollectionT1070.008 - Clear Mailbox DataT1098.002 - Additional Email Delegate PermissionsS0413 - MailSniperT1137.002 - Office TestT1137 - Office Application StartupT1137.001 - Office Template MacrosS0634 - EnvyScoutS0636 - VaporRageS0635 - BoomBoxTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationT1119 - Automated CollectionEmail SentEmail ReceivedEmail Attachment DownloadedEmail Phishing DetectedEmail Malware DetectedData ExfiltrationAdmin ActivityOffice 365M365 Unified Audit LogkqlNobeliumtactic:Collection

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?