Analytics
Informational
✕
Mailbox enumeration activity by Azure application
Microsoft Graph API was used to enumerate mailboxes in Azure tenant.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log, Microsoft Graph Logs
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Cloud Service Discovery (T1526)
Detector tags: Microsoft Graph Activity Logs
Attacker's goals:
To extract sensitive information stored in mailboxes.
Investigative actions:
Determine which mailboxes were enumerated and whether they contained any sensitive information. Investigate the identity following actions.
- Test period:
- 10 Minutes
- Deduplication:
- 5 Days
1 variation:
- Mailbox enumeration activity by Azure user Informational