User moved Exchange sent messages to deleted items

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	Requires: Office 365 Audit
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Indicator Removal: Clear Mailbox Data (T1070.008)
Severity	Informational

A user moved sent messages to deleted items in Exchange.

An attacker is attempting to hide newly sent email messages for evasion purposes.

Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
Investigate the IP address associated with the activity.
Follow further actions done by the account.
Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
Examine the user's email activity history for suspicious behavior.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Indicator Removal: Clear Mailbox Data (T1070.008)
Severity	Low

A user moved sensitive sent messages to deleted items in Exchange.

An attacker is attempting to hide newly sent email messages for evasion purposes.

Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
Investigate the IP address associated with the activity.
Follow further actions done by the account.
Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
Examine the user's email activity history for suspicious behavior.