Splunk unknown stable spl

O365 OAuth App Mailbox Access via EWS

The following analytic detects when emails are accessed in Office 365 Exchange via Exchange Web Services (EWS) using OAuth-authenticated applications. It leverages the ClientInfoString field to identify EWS interactions and aggregates metrics such as access counts, timing, and client IP addresses, categorized by user, ClientAppId, OperationCount, and AppId. Monitoring OAuth applications accessing emails through EWS is crucial for identifying potential abuse or unauthorized data access. If confirmed malicious, this activity could lead to unauthorized email access, data exfiltration, or further compromise of sensitive information.

View Source

Detection Logic

`o365_management_activity` Workload=Exchange Operation=MailItemsAccessed AppId=* ClientAppId=*
| regex ClientInfoString="^Client=WebServices;ExchangeWebServices"
| fillnull
| stats count earliest(_time) as firstTime latest(_time) as lastTime values(ClientIPAddress) as src
    BY user ClientAppId OperationCount
       AppId vendor_account vendor_product
       dest signature ClientInfoString
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_oauth_app_mailbox_access_via_ews_filter`

False Positives

  • ⚠ OAuth applications may access mailboxes for legitimate purposes, you can use the src_ip to add trusted sources to an allow list.

Field Validations

Loading…

Comments (0)

Loading comments...