Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

MailItemsAccessed Defense

Steven Lim@KQLWizard

•updated Jul 1, 2025•8•0•93

KQL Query from file: MailItemsAccessed Defense

Microsoft Sentinel (KQL)

Tags

T1110 - Brute Force T1110.003 - Password Spraying T1078 - Valid Accounts T1071 - Application Layer Protocol T1090.003 - Multi-hop Proxy T1114 - Email Collection TA0006 - Credential Access TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0011 - Command and Control TA0009 - Collection S0183 - Tor Authentication Attempt Credential Access Email Received Email Sent Cloud Api Call Office 365 M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?