Suspicious mailbox Search and MailItemsAccessed activity in M365

Kaung Khant Ko@kaungkhantko

•updated Aug 10, 2026•5•0•22

This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.