Sunturai
Back to results
MediumSplunk security contentSteven Dick

O365 Email Suspicious Behavior Alert

The following analytic identifies when one of O365 the built-in security detections for suspicious email behaviors are triggered. These alerts often indicate that an attacker may have compromised a mailbox within…

Description

The following analytic identifies when one of O365 the built-in security detections for suspicious email behaviors are triggered. These alerts often indicate that an attacker may have compromised a mailbox within the environment. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.

Detection logic

Detection requirements

Platform
LinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
office_365_universal_audit_log

Known benign triggers

  • Users emailing for legitimate business purposes that appear suspicious.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice