User moved Exchange sent messages to deleted items

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2024-12-03
Category
Analytics Alert Reference
Order
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

10 Minutes

Deduplication Period

1 Day

Required Data

  • Requires:
    • Office 365 Audit

Detection Modules

Identity Threat Module

Detector Tags

ATT&CK Tactic

Defense Evasion (TA0005)

ATT&CK Technique

Indicator Removal: Clear Mailbox Data (T1070.008)

Severity

Informational

Description

A user moved sent messages to deleted items in Exchange.

Attacker's Goals

An attacker is attempting to hide newly sent email messages for evasion purposes.

Investigative actions

  • Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
  • Investigate the IP address associated with the activity.
  • Follow further actions done by the account.
  • Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
  • Examine the user's email activity history for suspicious behavior.

Variations

Sensitive Exchange sent messages moved to deleted items from unusual source

Synopsis

ATT&CK Tactic

Defense Evasion (TA0005)

ATT&CK Technique

Indicator Removal: Clear Mailbox Data (T1070.008)

Severity

Low

Description

A user moved sensitive sent messages to deleted items in Exchange.

Attacker's Goals

An attacker is attempting to hide newly sent email messages for evasion purposes.

Investigative actions

  • Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
  • Investigate the IP address associated with the activity.
  • Follow further actions done by the account.
  • Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).
  • Examine the user's email activity history for suspicious behavior.