Multiple Mailbox Permission Additions in Exchange

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

This rule detects when a user adds mailbox permissions to three or more mailboxes within a one-hour window in Exchange Online. This behavior can indicate an adversary attempting to gain persistent access to multiple mailboxes, often for data exfiltration or further compromise.