Microsoft Graph Email Access by Unusual User and Client

Last updated a month ago on 2026-07-02

Created a year ago on 2025-05-06

About

Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID, user principal object ID, and source ASN have not been seen doing this activity historically.

Tags

Domain: CloudDomain: EmailData Source: AzureData Source: Microsoft GraphData Source: Microsoft Graph Activity LogsUse Case: Threat DetectionTactic: CollectionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Email Collection (T1114)(external, opens in a new tab or window)

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Use Alternate Authentication Material (T1550)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.graphactivitylogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:azure.graphactivitylogs and
    azure.graphactivitylogs.result_signature:200 and
    azure.graphactivitylogs.properties.c_idtyp:user and
    azure.graphactivitylogs.properties.client_auth_method:0 and
    http.request.method:(DELETE or GET or PATCH or POST or PUT) and
    url.path:((/beta/me/* or /beta/users/* or /v1.0/me/* or /v1.0/users/*) and (*inbox* or *mail* or *messages*) and not *mailboxSettings*) and
    azure.graphactivitylogs.properties.app_id:* and
    azure.graphactivitylogs.properties.user_principal_object_id:* and
    source.as.number:*

Install detection rules in Elastic Security

Detect Microsoft Graph Email Access by Unusual User and Client in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).