High-rate MailItemsAccessed (10+/60s) via REST client w/ anomalous ClientAppId+APIId

Duo Tech@duotech

•updated Aug 10, 2026•2•0•12

Detects bursts of 10+ MailItemsAccessed events within 60 seconds via a REST client with a specific ClientAppId/APIId pairing, consistent with automated mailbox collection using a replayed AiTM-stolen session token.