Elastic Security Detection Rules

Microsoft Graph Request Email Access by Unusual User and Client

Last updated 6 days ago on 2026-03-19
Created a year ago on 2025-05-06

About

Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days.
Tags
Domain: CloudDomain: EmailData Source: AzureData Source: Microsoft GraphData Source: Microsoft Graph Activity LogsUse Case: Threat DetectionTactic: CollectionLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Email Collection (T1114)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-azure.graphactivitylogs-*
Related Integrations

azure(external, opens in a new tab or window)

Query
text code block:
event.dataset:azure.graphactivitylogs
    and azure.graphactivitylogs.properties.app_id:*
    and azure.graphactivitylogs.result_signature:200
    and azure.graphactivitylogs.properties.c_idtyp:user
    and azure.graphactivitylogs.properties.client_auth_method:0
    and http.request.method:(DELETE or GET or PATCH or POST or PUT)
    and (
        (
            url.path:(/v1.0/me/*cc or /v1.0/users/*)
            and (
                url.path:((*inbox* or *mail* or *messages*) and not *mailboxSettings*)
                or azure.graphactivitylogs.properties.requestUri:(*inbox* or *mail* or *messages*)
            )
        )
        or azure.graphactivitylogs.properties.scopes:(Mail.Read or Mail.ReadWrite or Mail.Send)
    )

Install detection rules in Elastic Security

Detect Microsoft Graph Request Email Access by Unusual User and Client in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).