Cross-tenant synchronized MailItemsAccessed collection bursts
Detects centralized automation collecting mail across 3+ tenants within a short synchronized window, consistent with coordinated mailbox collection infrastructure.
Microsoft Sentinel (KQL)
