Microsoft Graph Request Email Access by Unusual User and Client

Last updated 15 days ago on 2025-12-10

Created 8 months ago on 2025-05-06

About

Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days.

Tags

Domain: CloudData Source: AzureData Source: Microsoft GraphData Source: Microsoft Graph Activity LogsUse Case: Threat DetectionTactic: CollectionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Email Collection (T1114)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.graphactivitylogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.dataset: "azure.graphactivitylogs" and
azure.graphactivitylogs.properties.app_id: * and
azure.graphactivitylogs.result_signature: 200 and
azure.graphactivitylogs.properties.c_idtyp: "user" and
azure.graphactivitylogs.properties.client_auth_method: 0 and
http.request.method: (GET or POST or PUT or PATCH or DELETE) and (
  url.path: (/v1.0/me/*cc or /v1.0/users/*) and
  (
    url.path: (*mail* or *messages* or *inbox*) or
    azure.graphactivitylogs.properties.requestUri: (*mail* or *messages* or *inbox*)
  ) or
  azure.graphactivitylogs.properties.scopes: (
    "Mail.Read" or "Mail.ReadWrite" or "Mail.Send" or "email"
  )
)

Install detection rules in Elastic Security

Detect Microsoft Graph Request Email Access by Unusual User and Client in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).