Vasil Ivanov
@VibezsssCompletionist
0 followers3 downloads26 copies3 likes736 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
1
1
1
Platforms
2
1
Products / Services
1
MITRE Techniques
1
1
Detects when a single user deletes more than 25 emails within a 2-minute window. This behavior may indicate a compromised account, insider threat activity, data destruction attempt, or automated malicious script. The detection monitors Exchange operations including MoveToDeletedItems, SoftDelete, and HardDelete actions.
The query, as constructed, is primarily focused on detecting large outbound traffic volumes to external destinations on a per source-destination pair basis within daily aggregations. Adjust the threshold and aggregation criteria based on your specific security requirements and typical network behavior patterns.
// Discover email forwarding creation attempts outside of your organization.