detecting-email-account-compromise

name	detecting-email-account-compromise
description	Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs. Use when detecting compromised o365 and google workspace email accounts by analyzing.
domain	cybersecurity
subdomain	incident-response
tags	["email-compromise","office365","microsoft-graph","bec","inbox-rules","sign-in-analysis","account-takeover"]
mitre_attack	["T1114","T1566","T1078","T1534"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Detecting Email Account Compromise

Overview

Email account compromise (EAC) is a prevalent attack vector where adversaries gain unauthorized access to mailboxes to exfiltrate sensitive data, conduct business email compromise (BEC), or establish persistence through inbox rule manipulation. Attackers commonly create forwarding rules to siphon emails, delete rules to hide evidence, or use OAuth tokens for persistent access. Detection relies on analyzing Microsoft 365 Unified Audit Logs, Azure AD sign-in logs for impossible travel or suspicious locations, inbox rule creation events (Set-InboxRule, New-InboxRule), and Microsoft Graph API access patterns. Key indicators include forwarding rules to external addresses, rules that delete or move messages matching keywords like "invoice" or "payment", and sign-ins from unusual user agents such as python-requests.

When to Use

Trigger phrases:

• "detecting email account compromise"

• "Detect compromised O365 and Google Workspace email accounts by analyzing inbox r"

• When investigating security incidents that require detecting email account compromise

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Microsoft 365 with Unified Audit Logging enabled
• Azure AD P1/P2 for risk detection APIs
• Python 3.9+ with requests, msal libraries
• Microsoft Graph API application registration with Mail.Read, AuditLog.Read.All permissions
• Understanding of OAuth2 client credential flows

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}