[MSAPI-EXCHANGE] Excessive Volume of Mail Items Accessed
SAGAN detection rule by quadrantsec · GPL-2.0
alert any any any -> any any (msg:"[MSAPI-EXCHANGE] Excessive Volume of Mail Items Accessed"; program:Exchange; json_content: ".Operation","MailItemsAccessed"; json_meta_content: ".ClientInfoString",Client=OWA,Client=OutlookWebApp,Client=WebServices; meta_content:"%sagan%",invoice,payment,wire|20|transfer,ACH,remittance,purchase|20|order,PO|20 23|,billing,bank|20|details,account|20|number,urgent,confidential,action|20|required,approval|20|needed,authorization,vendor,contract,agreement,renewal,onboarding,password,reset,login,MFA,2FA,verification|20|code,your|20|account,direct|20|deposit,payroll,w-2,w2,bank|20|change,salary,benefits; meta_nocase; json_map:"username",".UserId"; json_map:"src_ip",".ClientIPAddress"; content:"|22|UserType|22 3a 20|0,"; content:"|22|LogonType|22 3a 20|0,"; after: track by_src&by_username, count 150, seconds 60; threshold: type suppress, track by_src&by_username, count 1, seconds 3600; classtype: collection; reference:url,https://learn.microsoft.com/en-us/purview/audit-mailboxes; sid:5017892; rev:2; metadata: createdOn 2026_04_16. updatedOn 2026_04_16, Mitre_TacticID TA0009, Mitre_TacticName Collection, Mitre_TechniqueID T1114.002, Mitre_TechniqueName EmailCollection;)