Elastic medium stable kql

Microsoft Graph Email Access by Unusual User and Client

Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID, user principal object ID, and source ASN have not been seen doing this activity historically.

View Source

Detection Logic

data_stream.dataset:azure.graphactivitylogs and
    azure.graphactivitylogs.result_signature:200 and
    azure.graphactivitylogs.properties.c_idtyp:user and
    azure.graphactivitylogs.properties.client_auth_method:0 and
    http.request.method:(DELETE or GET or PATCH or POST or PUT) and
    url.path:((/beta/me/* or /beta/users/* or /v1.0/me/* or /v1.0/users/*) and (*inbox* or *mail* or *messages*) and not *mailboxSettings*) and
    azure.graphactivitylogs.properties.app_id:* and
    azure.graphactivitylogs.properties.user_principal_object_id:* and
    source.as.number:*

Field Validations

Loading…

Comments (0)

Loading comments...