Suspicious Email Access by First-Party Application via Microsoft Graph

Last updated 8 days ago on 2025-05-06

Created 8 days ago on 2025-05-06

About

Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days.

Tags

Domain: CloudData Source: AzureData Source: Microsoft GraphData Source: Microsoft Graph Activity LogsUse Case: Threat DetectionTactic: CollectionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(opens in a new tab or window)

↳ Email Collection (T1114)(opens in a new tab or window)

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: filebeat-*logs-azure.graphactivitylogs-*
Related Integrations: azure(opens in a new tab or window)
Query

event.dataset: "azure.graphactivitylogs" and
azure.graphactivitylogs.properties.app_id: * and
azure.graphactivitylogs.result_signature: 200 and
azure.graphactivitylogs.properties.c_idtyp: "user" and
azure.graphactivitylogs.properties.client_auth_method: 0 and
http.request.method: (GET or POST or PUT or PATCH or DELETE) and (
  url.path: (/v1.0/me/*cc or /v1.0/users/*) and
  (
    url.path: (*mail* or *messages* or *inbox*) or
    azure.graphactivitylogs.properties.requestUri: (*mail* or *messages* or *inbox*)
  ) or
  azure.graphactivitylogs.properties.scopes: (
    "Mail.Read" or "Mail.ReadWrite" or "Mail.Send" or "email"
  )
)

Install detection rules in Elastic Security

Detect Suspicious Email Access by First-Party Application via Microsoft Graph in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).