Detection rules › By event

M365-ExchangeItemAggregated

Event	Rules
MailItemsAccessed	8

MailItemsAccessed

8 detection rules reference this event. View event page.

Elastic (3)

M365 Exchange Mailbox Accessed by Unusual Client severity medium T1114, T1114.002
M365 Exchange Mailbox Items Accessed Excessively severity medium T1114, T1114.002
M365 or Entra ID Identity Sign-in from a Suspicious Source severity high T1078

Splunk (3)

O365 Multiple Mailboxes Accessed via API severity medium T1114, T1114.002
O365 OAuth App Mailbox Access via EWS severity medium T1114, T1114.002
O365 OAuth App Mailbox Access via Graph API severity medium T1114, T1114.002

Kusto (1)

Exchange workflow MailItemsAccessed operation anomaly severity medium T1114

YARA-L (1)

Office 365 mail accessed via unexpected application severity medium