O365 MailItemsAccessed via undocumented ClientAppId/APIId pairing (AiTM replay)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects anomalous access to email items in Microsoft 365 Exchange environments by monitoring the 'MailItemsAccessed' operation. The rule flags specific, non-standard pairings of 'ClientAppId' and 'APIId' associated with malicious activity, indicating potential unauthorized data collection or exfiltration by attackers bypassing standard Outlook client behavior.