Payroll Pirate: M365 Mailbox Search for HR/Payroll Keywords After Suspicious Sign-in

Ibrahim Saud@tektrix

•updated Jun 29, 2026•5•0•5

This rule detects potential post-compromise mailbox reconnaissance by correlating suspicious sign-in events (non-interactive or unmanaged device usage, often associated with AiTM token replay) with subsequent mailbox or compliance search operations targeting payroll and HR-related keywords within a 60-minute window.