Automated Mailbox Scanning for Financial/BEC Keywords via Captured Tokens

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detects Microsoft 365 MailItemsAccessed events where the email subject or body contains finance-related keywords such as 'invoice', 'payment', 'bank details', or 'wire'. This activity may indicate malicious mailbox scanning or data collection, often associated with unauthorized access or automated enumeration tools like the ARToken Inbox Monitor.