Cross-Tenant Synchronized MailItemsAccessed Collection Burst

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.