MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1114Email Collection

Collection

View on MITRE ATT&CK →

1 Query

Suspicious Mailbox Access via Delegated or Application Permissions

mediumtestingMicrosoft Sentinel

Microsoft 365·OfficeActivity

OfficeActivity
| where TimeGenerated > ago(1d)
| where Operation in ("MailItemsAccessed", "MailboxLogin")
| where UserId != MailboxOwnerUPN
| where ResultStatus == "Succeeded"
| project TimeGenerated, UserId, MailboxOwnerUPN, Operation, ClientIPAddress, UserAgent
| sort by TimeGenerated desc

FalconForce Team (adapted) · last tested 2025-03-01

attack.mitre.org
github.com

Tuning notes

Shared mailboxes and delegate access are common. Exclude known shared mailbox UPNs and service accounts with legitimate delegated access.

+ Add another query for this technique →