Hunt for Admin email access

Description

This query helps report on email access by administrators

Query · kql

CloudAppEvents
| where ActionType == "AdminMailAccess"
| extend data = RawEventData["ExtendedProperties"]
| extend OpenedMailbox = data[1].["Value"]
| extend OpenedEmail = url_decode(tostring(data[2].["Value"]))
| project AccountDisplayName, ActionType, OpenedMailbox, OpenedEmail
| join EmailEvents on $left.OpenedEmail == $right.InternetMessageId
| project Timestamp , Actor = AccountDisplayName, ActionType, OpenedMailbox, SenderFromAddress, RecipientEmailAddress, Subject
| order by Timestamp desc
Raw source Hunt for Admin email access · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: e55e178e-48ba-4313-918a-2d3e16a95441
name: Hunt for Admin email access
description: |
  This query helps report on email access by administrators
description-detailed: |
  This query helps report on email access by administrators using the CloudAppEvents table log information.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- PrivilegeEscalation
relevantTechniques:
  - T1078
query: |
  CloudAppEvents
  | where ActionType == "AdminMailAccess"
  | extend data = RawEventData["ExtendedProperties"]
  | extend OpenedMailbox = data[1].["Value"]
  | extend OpenedEmail = url_decode(tostring(data[2].["Value"]))
  | project AccountDisplayName, ActionType, OpenedMailbox, OpenedEmail
  | join EmailEvents on $left.OpenedEmail == $right.InternetMessageId
  | project Timestamp , Actor = AccountDisplayName, ActionType, OpenedMailbox, SenderFromAddress, RecipientEmailAddress, Subject
  | order by Timestamp desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.