Sunturai
Back to results
InformationalSplunk security contentSteven Dick

O365 Email Hard Delete Excessive Volume

The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor…

Description

The following analytic identifies when an O365 email account hard deletes an excessive number of emails within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to permanently purge a large amount of items from the mailbox. Threat actors may attempt to remove evidence of their activity by purging items from the compromised mailbox. --- Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
office_365_universal_audit_log

Known benign triggers

  • Users that habitually/proactively cleaning the recoverable items folder may trigger this alert.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice