Analytics
Informational
✕
User moved Exchange sent messages to deleted items
A user moved sent messages to deleted items in Exchange.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security
- Licensed by:
- Identity Threat Detection (ITDR)
- Licensed by:
- Email Security
- Data source:
- Office 365 Audit
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Indicator Removal: Clear Mailbox Data (T1070.008)
Attacker's goals:
An attacker is attempting to hide newly sent email messages for evasion purposes.
Investigative actions:
Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity). Investigate the IP address associated with the activity. Follow further actions done by the account. Look for unusual email patterns from the affected mailbox (e.g. unusual email contents). Examine the user's email activity history for suspicious behavior.
- Test period:
- 10 Minutes
- Deduplication:
- 1 Day
1 variation:
- Sensitive Exchange sent messages moved to deleted items from unusual source Low (parent: Informational)