O365 Email Access By Security Administrator

name: O365 Email Access By Security Administrator
id: c6998a30-fef4-4e89-97ac-3bb0123719b4
version: 11
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=SecurityComplianceCenter Operation=AdminMailAccess
      | rename InternetMessageId as signature_id, UserId as src_user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           src_user signature_id
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_email_access_by_security_administrator_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Threat Explorer is a premium feature with o365, logging may not be available with proper license.
known_false_positives: Legitamate access by security administators for incident response measures.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-investigate-delivered-malicious-email?view=o365-worldwide
finding:
    title: A security administrator $src_user$ accessed email messages for $user$
    entity:
        field: src_user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: A security administrator $src_user$ accessed email messages for $user$
analytic_story:
    - Data Exfiltration
    - Azure Active Directory Account Takeover
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1114.002
    - T1567
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat