Office 365 mail accessed via unexpected application

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

 rule o365_mail_access_api {

  meta:
    author = "Google Cloud Security"
    description = "Detect mail items accessed via API through an unapproved Entra ID application."
    rule_id = "mr_c8d8368c-db01-4903-a81f-bab51fc1a732"
    rule_name = "Office 365 mail accessed via unexpected application"
    type = "alert"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    $email.metadata.event_type = "EMAIL_UNCATEGORIZED"
    $email.metadata.product_event_type = "MailItemsAccessed"
    $email.metadata.product_name = "Office 365"
    $email.metadata.vendor_name = "Microsoft"
    $email.security_result.action = "ALLOW"
    $email.network.http.user_agent = /Client=REST;/ nocase
    //Reference list could be used; add Entra ID applications that users would normally access mail through to this list so they are not detected
    NOT (
    $email.target.labels["ClientAppId"] = "a3883eba-fbe9-48bd-9ed3-dca3e0e84250" or //Exchange Online
    $email.target.labels["ClientAppId"] = "13937bba-652e-4c46-b222-3003f4d1ff97" or //Substrate Context Service
    $email.target.labels["ClientAppId"] = "d3590ed6-52b3-4102-aeff-aad2292ab01c" //Microsoft Office
    )
    //$email.target.labels["ClientAppId"] != ""
    $email.principal.user.userid = $user

  match:
    $user over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($email.metadata.id)
    $user_agent = array_distinct($email.network.http.user_agent)
    $target_application = array_distinct($email.target.application)
    $principal_user_userid = array_distinct($email.principal.user.userid)
    $application_guid = array_distinct($email.target.labels["ClientAppId"])
    $mail_folder = array_distinct($email.about.resource.name)

  condition:
    $email
}