Detection rules › By catalog entry

M365-ExchangeItemAggregated

Catalog entry	Rules
MailItemsAccessed	8

MailItemsAccessed

8 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

M365 Exchange Mailbox Accessed by Unusual Client severity medium T1114,T1114.002
M365 Exchange Mailbox Items Accessed Excessively severity medium T1114,T1114.002
M365 or Entra ID Identity Sign-in from a Suspicious Source severity high T1078

Splunk (3)

O365 Multiple Mailboxes Accessed via API severity medium T1114,T1114.002
O365 OAuth App Mailbox Access via EWS severity medium T1114,T1114.002
O365 OAuth App Mailbox Access via Graph API severity medium T1114,T1114.002

Kusto (1)

Exchange workflow MailItemsAccessed operation anomaly severity medium T1114

YARA-L (1)

Office 365 mail accessed via unexpected application severity medium

Back to all M365-ExchangeItemAggregated catalog entries