Microsoft 365 Anomalous Amount of Deleted Emails

microsoft-365

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1485-data-destruction

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when an anomalous amount of emails are deleted from Microsoft 365 Exchange.

Strategy

Monitor Microsoft 365 Exchange audit logs to look for events with an @evt.name value of HardDelete, where the @Folder.Path is the inbox (*Inbox*).

Triage and response

  1. Determine if the user {{@usr.id}} intended to delete the observed emails.
  2. If {{@usr.id}} is not responsible for the email deletions, investigate {{@usr.id}} for anomalous activity. If necessary, initiate your company’s incident response (IR) process.