<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-email-account-compromise
description: >-
  Detect compromised email accounts through behavioral analysis, impossible
  travel detection, mailbox rule anomalies, OAuth app abuse, and unauthorized
  access patterns in enterprise email environments.
domain: cybersecurity
subdomain: email-security
tags:
  - account-compromise
  - bec
  - oauth-abuse
  - impossible-travel
  - detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078", "T1114.002", "T1098.002"]
  tools: [exchange-powershell, azure-ad, kql, splunk]
---

# Detecting Email Account Compromise

## Overview

Email account compromise (EAC) is a precursor to BEC, data exfiltration, and
lateral phishing. Detection relies on identifying anomalous login patterns,
suspicious mailbox rule creation, OAuth consent grants, mail forwarding
changes, and abnormal email sending behavior.

## Prerequisites

- Tools: Exchange PowerShell, Azure AD, KQL, Splunk
- Access to sign-in logs and unified audit log
- Baseline of normal user email behavior

## Key Concepts

- **Impossible travel**: Logins from distant locations in short timeframes
- **Inbox rule persistence**: Attackers create rules to hide their activity
- **OAuth consent abuse**: Malicious apps granted mail read/send permissions
- **Lateral phishing**: Compromised account sending phishing to internal users

## Workflow

### Step 1: Login Anomaly Detection

```kql
// Impossible travel detection
SigninLogs
| where TimeGenerated > ago(24h) and ResultType == 0
| summarize locations=make_set(Location) by UserPrincipalName
| where array_length(locations) > 2

// Brute force followed by success
SigninLogs
| where TimeGenerated > ago(1h)
| summarize
    failures=countif(ResultType != 0),
    successes=countif(ResultType == 0)
  by UserPrincipalName
| where failures > 5 and successes > 0
```

### Step 2: Mailbox Rule Anomaly Detection

```powershell
# Check for suspicious inbox rules
Get-InboxRule -Mailbox "user@example.com" | Where {
  $_.DeleteMessage -eq $true -or
  $_.ForwardTo -ne $null -or
  $_.RedirectTo -ne $null -or
  $_.MoveToFolder -match "RSS|Deleted"
} | Select Name, ForwardTo, DeleteMessage

# Audit log for rule creation
Search-UnifiedAuditLog -Operations "New-InboxRule","Set-InboxRule" \
  -StartDate (Get-Date).AddDays(-30)
```

### Step 3: OAuth App Consent Analysis

```kql
// Suspicious OAuth consent grants
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName == "Consent to application"
| extend Permissions = tostring(TargetResources[0].modifiedProperties)
| where Permissions has_any ("Mail.Read", "Mail.ReadWrite", "Mail.Send")

// Illicit consent grant patterns
AuditLogs
| where OperationName == "Consent to application"
| extend AppId = tostring(TargetResources[0].id)
| summarize count() by AppId
| where count_ > 10
```

### Step 4: Sending Pattern Analysis

```kql
// Unusual send volume
OfficeActivity
| where TimeGenerated > ago(24h) and Operation == "Send"
| summarize SentCount=count() by UserId, bin(TimeGenerated, 1h)
| where SentCount > 50

// Emails to unusual external domains
OfficeActivity
| where Operation == "Send"
| where RecipientAddress !endswith "example.com"
| summarize count() by UserId
| where count_ > 20
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Impossible travel | Azure AD | Distant logins in short timeframe |
| Suspicious rules | Exchange audit | Rules forwarding or deleting mail |
| OAuth consent | Azure AD audit | Apps granted mail permissions |
| Abnormal sending | Exchange logs | Volume exceeds user baseline |

```yaml
title: Suspicious Email Inbox Rule Created
id: c9d0e1f2-a3b4-5678-c012-901234567890
status: experimental
description: Detects inbox rules that forward or delete emails
logsource:
  category: application
  product: m365
detection:
  selection:
    Operation:
      - "New-InboxRule"
      - "Set-InboxRule"
  keywords:
    Parameters|contains:
      - "ForwardTo"
      - "RedirectTo"
      - "DeleteMessage"
  condition: selection and keywords
falsepositives:
  - Legitimate forwarding rules during vacation
level: high
tags:
  - attack.t1114.002
  - attack.collection
```

## Verification

- [ ] Login anomaly detection deployed
- [ ] Mailbox rule monitoring active
- [ ] OAuth consent grant monitoring configured
- [ ] Email sending baseline and anomaly alerts active
- [ ] Automated response playbook for confirmed compromise

## References

- [MITRE T1114.002 — Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
- [Microsoft BEC Investigation](https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-compromised-malicious-app)
- [CISA BEC Advisory](https://www.cisa.gov/topics/cyber-threats-and-advisories)
