Back to Details

email-and-collaboration

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Email & Collaboration — detection-relevant internals

电子邮件与协作——与检测相关的内部机制

This skill encodes how M365 email and collaboration services work at the level needed to detect BEC, phishing, data exfiltration, and insider threats through these channels.
Scope: This skill covers Microsoft 365 (Exchange Online, SharePoint, OneDrive, Teams). Google Workspace, Slack, and other collaboration platforms are not covered. SIEM table names vary by platform — consult the relevant platform skill for ingestion specifics.
本 skill 编码了 M365 电子邮件与协作服务的工作机制，其细节层级足以通过这些渠道检测 BEC、网络钓鱼、数据外泄和内部人员威胁。
范围：本 skill 覆盖 Microsoft 365（Exchange Online、SharePoint、OneDrive、Teams）。不涵盖 Google Workspace、Slack 和其他协作平台。SIEM 表名因平台而异——有关数据摄取的具体信息，请参阅相应的平台 skill。

1. Exchange Online mail flow

1. Exchange Online 邮件流

Message lifecycle

消息生命周期

Sender → Exchange Online Transport Pipeline
  → Transport rules (mail flow rules) evaluated
  → DLP policies evaluated
  → Connector routing (on-prem, partner, internet)
  → Recipient mailbox delivery
  → Post-delivery actions (ZAP, Safe Links rewrite)
发件人 → Exchange Online 传输管道
  → 评估传输规则（Transport rules）
  → 评估 DLP 策略
  → 连接器路由（本地部署、合作伙伴、Internet）
  → 收件人邮箱投递
  → 投递后操作（ZAP、Safe Links 重写）

Detection-relevant mail flow concepts

与检测相关的邮件流概念

ConceptDetailDetection signal
Transport rulesAdmin-created rules that modify, redirect, or block mailNew transport rule creation = potential BEC infrastructure. 
Set-TransportRule
in UAL.
Journal rulesCopy all mail to a journal mailboxNew journal rule = potential exfiltration. 
New-JournalRule
in UAL.
ConnectorsRoute mail to/from external systemsNew outbound connector = potential mail redirection.
ZAP (Zero-hour Auto Purge)Retroactively removes malicious messages post-delivery
ZAP
events in 
EmailPostDeliveryEvents
(Defender).
Safe LinksURL rewriting for click-time protection
UrlClickEvents
(Defender) shows user clicks on rewritten URLs.
概念详情检测信号
传输规则（Transport rules）管理员创建，用于修改、重定向或阻止邮件的规则创建新传输规则可能意味着出现 BEC 基础设施。UAL 中记录 
Set-TransportRule
。
Journal 规则将所有邮件副本复制到 journal 邮箱创建新 Journal 规则可能意味着数据外泄。UAL 中记录 
New-JournalRule
。
连接器（Connectors）将邮件路由至外部系统或从外部系统路由邮件创建新的出站连接器可能意味着邮件被重定向。
ZAP (Zero-hour Auto Purge)在投递后追溯删除恶意邮件Defender 的 
EmailPostDeliveryEvents
中存在 
ZAP
事件。
Safe Links通过重写 URL 提供点击时保护Defender 的 
UrlClickEvents
会显示用户对重写 URL 的点击。

2. Mailbox delegation and forwarding

2. 邮箱委派与转发

Forwarding mechanisms (BEC critical)

转发机制（BEC 关键项）

MechanismHow it worksDetectionPersistence level
Inbox rulesUser-created rule forwarding/redirecting mail
New-InboxRule
, 
Set-InboxRule
in UAL. 
OfficeActivity
with 
Operation
= 
New-InboxRule
.		Per-mailbox, survives password change
SMTP forwarding
ForwardingSmtpAddress
on mailbox
Set-Mailbox
with 
ForwardingSmtpAddress
parameter.		Admin-level, survives password change
Transport rule forwardingOrg-wide rule redirecting mail
New-TransportRule
in UAL.		Org-wide, admin-only
Power Automate flowAutomated flow forwarding mailFlow creation events in UAL.Per-user, survives password change
Delegate accessAnother user granted access to mailbox
Add-MailboxPermission
in UAL.		Admin-level
机制工作方式检测方式持久化级别
收件箱规则（Inbox rules）用户创建，用于转发或重定向邮件的规则UAL 中记录 
New-InboxRule
、
Set-InboxRule
。
OfficeActivity
的 
Operation
= 
New-InboxRule
。		邮箱级别，密码更改后仍会保留
SMTP 转发邮箱上的 
ForwardingSmtpAddress
使用 
ForwardingSmtpAddress
参数执行 
Set-Mailbox
。		管理员级别，密码更改后仍会保留
传输规则转发重定向邮件的组织级规则UAL 中记录 
New-TransportRule
。		组织级别，仅限管理员
Power Automate 流自动转发邮件的流UAL 中的流创建事件。用户级别，密码更改后仍会保留
委派访问（Delegate access）向另一用户授予邮箱访问权限UAL 中记录 
Add-MailboxPermission
。		管理员级别

BEC forwarding detection priority

BEC 转发检测优先级

  1. Inbox rules with external forwarding — most common BEC persistence. Look for rules with 
    ForwardTo
    , 
    RedirectTo
    , or 
    DeleteMessage
    actions targeting external addresses.
  2. SMTP forwarding to external domain — silent, admin-level. Check 
    ForwardingSmtpAddress
    on all mailboxes.
  3. Delegate access grants — 
    FullAccess
    , 
    SendAs
    , 
    SendOnBehalf
    to unexpected users.
  1. 带外部转发的收件箱规则——最常见的 BEC 持久化手段。查找包含 
    ForwardTo
    、
    RedirectTo
    或 
    DeleteMessage
    操作，且目标为外部地址的规则。
  2. 向外部域进行 SMTP 转发——静默且属于管理员级别。检查所有邮箱上的 
    ForwardingSmtpAddress
    。
  3. 委派访问授权——检查是否向意外用户授予了 
    FullAccess
    、
    SendAs
    或 
    SendOnBehalf
    。

3. OAuth app permissions on mailboxes

3. 邮箱上的 OAuth 应用权限

Application permissions (daemon access, no user context)

应用程序权限（daemon 访问，无用户上下文）

PermissionWhat it grantsRisk
Mail.Read
(Application)		Read all mail in all mailboxesFull email exfiltration
Mail.ReadWrite
(Application)		Read/write all mailEmail manipulation + exfiltration
Mail.Send
(Application)		Send mail as any userBEC impersonation
MailboxSettings.ReadWrite
(Application)		Modify mailbox settingsCreate forwarding rules silently
Detection: 
AuditLogs
with 
OperationName
= 
Consent to application
. Check 
TargetResources[0].modifiedProperties
for granted permissions. Application permissions (vs delegated) are higher risk — they don't require user context.
权限授权内容风险
Mail.Read
(Application)		读取所有邮箱中的所有邮件完整邮件外泄
Mail.ReadWrite
(Application)		读取和写入所有邮件邮件篡改与外泄
Mail.Send
(Application)		以任意用户身份发送邮件BEC 冒充
MailboxSettings.ReadWrite
(Application)		修改邮箱设置静默创建转发规则
检测：
AuditLogs
中 
OperationName
= 
Consent to application
。检查 
TargetResources[0].modifiedProperties
中已授予的权限。应用程序权限（而非 delegated 权限）风险更高——不需要用户上下文。

4. MailItemsAccessed

4. MailItemsAccessed

MailItemsAccessed
is a critical audit event (requires M365 E5 or Audit Premium) that logs every time a mail item is read.
FieldDetailDetection use
MailAccessType
Bind
(individual item) or 
Sync
(folder sync)
Sync
from unexpected client = bulk exfiltration
ClientInfoString
Application identifier
Client=OWA
vs 
Client=REST;Client=RESTSystem
— REST API access from non-standard apps
OperationCount
Number of items accessedHigh count in short window = bulk access
SessionId
Session correlationCorrelate with sign-in events
Detection patterns:
  • Sync
    operations from non-standard clients (not Outlook, OWA, or mobile)
  • High 
    OperationCount
    from a single session
  • MailItemsAccessed
    from an IP that doesn't match the user's sign-in IP
  • Access to mailboxes the user doesn't normally access (delegate abuse)
MailItemsAccessed
是一项关键审计事件（需要 M365 E5 或 Audit Premium），每次读取邮件项时都会记录。
字段详情检测用途
MailAccessType
Bind
（单个项目）或 
Sync
（文件夹同步）		来自意外客户端的 
Sync
操作意味着可能发生批量外泄
ClientInfoString
应用程序标识符
Client=OWA
与 
Client=REST;Client=RESTSystem
对比——可识别来自非标准应用的 REST API 访问
OperationCount
已访问的项目数量短时间内数量过高意味着批量访问
SessionId
会话关联与登录事件进行关联
检测模式：
  • 来自非标准客户端的 
    Sync
    操作（Outlook、OWA 或移动客户端除外）
  • 单次会话中的 
    OperationCount
    过高
  • MailItemsAccessed
    来自与用户登录 IP 不匹配的 IP 地址
  • 访问用户通常不会访问的邮箱（委派滥用）

5. SharePoint / OneDrive

5. SharePoint / OneDrive

External sharing

外部共享（External sharing）

Sharing levelRiskDetection signal
Anyone linkHighest — no authentication required
SharingSet
with 
TargetUserOrGroupType
= 
Guest
and link type = 
Anonymous
Specific people (external)Medium — requires authentication
SharingInvitationCreated
with external email
Organisation-wideLow (internal)
SharingSet
with org-wide scope
共享级别风险检测信号
任何人链接最高——无需身份验证
SharingSet
的 
TargetUserOrGroupType
= 
Guest
，且链接类型 = 
Anonymous
特定人员（外部）中等——需要身份验证
SharingInvitationCreated
，且使用外部邮箱
全组织范围低（内部）
SharingSet
的范围为全组织

Detection-relevant operations

与检测相关的操作

OperationUAL eventDetection use
File downloaded
FileDownloaded
Bulk download = exfiltration
File shared externally
SharingSet
, 
SharingInvitationCreated
Data leak
Sharing link created
AnonymousLinkCreated
Anyone-accessible link
Site permission changed
SiteCollectionAdminAdded
Privilege escalation
Sensitivity label removed
SensitivityLabelRemoved
DLP bypass
File synced
FileSyncDownloadedFull
Bulk sync to unmanaged device
操作UAL 事件检测用途
文件下载
FileDownloaded
批量下载意味着数据外泄
文件对外共享
SharingSet
、
SharingInvitationCreated
数据泄露
创建共享链接
AnonymousLinkCreated
任何人均可访问的链接
站点权限变更
SiteCollectionAdminAdded
权限提升
移除敏感度标签
SensitivityLabelRemoved
绕过 DLP
文件同步
FileSyncDownloadedFull
批量同步至非托管设备

6. Microsoft Teams

6. Microsoft Teams

Detection-relevant Teams operations

与检测相关的 Teams 操作

OperationUAL eventDetection use
Guest added to team
MemberAdded
with 
MemberRoleType
= 
Guest
External access
External user messaged
MessageSent
to external recipient		Data leak via chat
App installed in team
AppInstalled
Malicious app / OAuth abuse
Meeting recording accessed
RecordingAccessed
Sensitive content access
Channel created
ChannelAdded
Shadow IT / unauthorised collaboration
Connector added
ConnectorAdded
Webhook-based data exfiltration
操作UAL 事件检测用途
将来宾添加到团队
MemberAdded
，且 
MemberRoleType
= 
Guest
外部访问
向外部用户发送消息向外部收件人触发 
MessageSent
通过聊天泄露数据
在团队中安装应用
AppInstalled
恶意应用或 OAuth 滥用
访问会议录制
RecordingAccessed
敏感内容访问
创建频道
ChannelAdded
Shadow IT 或未经授权的协作
添加连接器
ConnectorAdded
基于 Webhook 的数据外泄

7. Unified Audit Log (UAL) — Purview

7. Unified Audit Log (UAL)——Purview

The UAL is the central audit log for all M365 services. Key considerations:
AspectDetail
Retention180 days (E5/Audit Premium) or 90 days (standard)
Latency60-90 minutes typical; can be up to 24 hours for some workloads
Search
Search-UnifiedAuditLog
PowerShell cmdlet or Purview compliance portal
SIEM ingestionVia diagnostic settings, Office 365 Management Activity API, or platform-specific connectors. Consult your platform skill for table names.
UAL 是所有 M365 服务的中央审计日志。关键注意事项：
方面详情
保留期（Retention）180 天（E5/Audit Premium）或 90 天（标准版）
延迟（Latency）通常为 60–90 分钟；部分工作负载最长可能达到 24 小时
搜索（Search）
Search-UnifiedAuditLog
PowerShell cmdlet 或 Purview 合规门户
SIEM 摄取通过诊断设置、Office 365 Management Activity API 或平台专用连接器完成。有关表名，请参阅相应的平台 skill。

Critical UAL record types

关键 UAL 记录类型

RecordTypeServiceKey operations
ExchangeItem
ExchangeMail access, send, delete
ExchangeAdmin
ExchangeMailbox config, transport rules
SharePoint
SharePoint/OneDriveFile operations, sharing
AzureActiveDirectory
Entra IDSign-in, directory changes
MicrosoftTeams
TeamsMessaging, meetings, apps
PowerBI
Power BIReport access, sharing
SecurityComplianceCenter
PurviewDLP, retention, eDiscovery
RecordType服务关键操作
ExchangeItem
Exchange邮件访问、发送、删除
ExchangeAdmin
Exchange邮箱配置、传输规则
SharePoint
SharePoint/OneDrive文件操作、共享
AzureActiveDirectory
Entra ID登录、目录变更
MicrosoftTeams
Teams消息、会议、应用
PowerBI
Power BI报表访问、共享
SecurityComplianceCenter
PurviewDLP、保留、eDiscovery

8. BEC detection patterns

8. BEC 检测模式

Pattern 1: Account compromise → inbox rule → financial fraud

模式 1：账户入侵 → 收件箱规则 → 金融欺诈

1. Credential phishing (AiTM) → successful sign-in from anomalous location
2. Inbox rule created: forward/redirect to external address, or delete messages matching keywords
3. Attacker monitors email for financial transactions
4. Attacker sends fraudulent payment instructions from compromised account
Detection chain: Risky sign-in event → inbox rule creation (forward/redirect to external) → outbound email with financial keywords. Correlate across identity logs, UAL, and email delivery logs.
1. 凭据钓鱼（AiTM）→ 从异常位置成功登录
2. 创建收件箱规则：转发/重定向至外部地址，或删除匹配关键词的邮件
3. 攻击者监控邮件中的金融交易
4. 攻击者从已入侵的账户发送虚假付款指示
检测链：高风险登录事件 → 收件箱规则创建（转发/重定向至外部地址）→ 包含财务关键词的出站邮件。跨身份日志、UAL 和电子邮件投递日志进行关联。

Pattern 2: OAuth consent phishing → persistent access

模式 2：OAuth consent 钓鱼 → 持久访问

1. Phishing email with OAuth consent link
2. User grants permissions to malicious app
3. App accesses mail/files via Graph API without further authentication
4. Access persists even after password change
Detection: Consent grant event with high-privilege permissions (
Mail.Read
, 
Files.ReadWrite.All
). App not in organisation's approved list. See 
entra-id
skill for consent monitoring.
1. 包含 OAuth consent 链接的钓鱼邮件
2. 用户向恶意应用授予权限
3. 应用通过 Graph API 访问邮件/文件，且无需进一步身份验证
4. 即使密码更改，访问权限仍会保留
检测：consent 授权事件包含高权限（
Mail.Read
、
Files.ReadWrite.All
），且该应用不在组织批准列表中。有关 consent 监控，请参阅 
entra-id
skill。

Pattern 3: Insider threat — bulk data exfiltration

模式 3：内部人员威胁——批量数据外泄

1. User downloads large volumes of files from SharePoint/OneDrive
2. User shares files externally via anonymous links
3. User forwards email to personal account
Detection: Volume-based anomaly on 
FileDownloaded
+ 
AnonymousLinkCreated
+ 
Set-Mailbox ForwardingSmtpAddress
per user per time window.
1. 用户从 SharePoint/OneDrive 下载大量文件
2. 用户通过匿名链接对外共享文件
3. 用户将邮件转发至个人账户
检测：按用户和时间窗口对 
FileDownloaded
+ 
AnonymousLinkCreated
+ 
Set-Mailbox ForwardingSmtpAddress
进行基于数据量的异常检测。

9. Telemetry sources

9. 遥测来源

M365 operationUAL operation nameAPI sourceLicence
Email delivery
MailItemsAccessed
, 
Send
Office 365 Management Activity APIE3/E5
Email URL clicks
ClickData
Defender for Office 365 APIDefender P1/P2
Email attachments(embedded in delivery events)Defender for Office 365 APIDefender P1/P2
Post-delivery actions (ZAP)
ZAP
Defender for Office 365 APIDefender P1/P2
Inbox rule changes
New-InboxRule
, 
Set-InboxRule
Office 365 Management Activity APIE3/E5
Mailbox config changes
Set-Mailbox
Office 365 Management Activity APIE3/E5
SharePoint file operations
FileDownloaded
, 
FileUploaded
, 
AnonymousLinkCreated
Office 365 Management Activity APIE3/E5
Teams operations
MemberAdded
, 
ChatCreated
Office 365 Management Activity APIE3/E5
MailItemsAccessed
MailItemsAccessed
Office 365 Management Activity APIE5 / Audit Premium
Map these operations to your SIEM's tables/indexes. Consult the relevant platform skill (
microsoft-sentinel
, 
splunk-spl-processing
, etc.) for ingestion specifics.
M365 操作UAL 操作名称API 来源许可证
电子邮件投递
MailItemsAccessed
、
Send
Office 365 Management Activity APIE3/E5
电子邮件 URL 点击
ClickData
Defender for Office 365 APIDefender P1/P2
电子邮件附件（嵌入在投递事件中）Defender for Office 365 APIDefender P1/P2
投递后操作（ZAP）
ZAP
Defender for Office 365 APIDefender P1/P2
收件箱规则变更
New-InboxRule
、
Set-InboxRule
Office 365 Management Activity APIE3/E5
邮箱配置变更
Set-Mailbox
Office 365 Management Activity APIE3/E5
SharePoint 文件操作
FileDownloaded
、
FileUploaded
、
AnonymousLinkCreated
Office 365 Management Activity APIE3/E5
Teams 操作
MemberAdded
、
ChatCreated
Office 365 Management Activity APIE3/E5
MailItemsAccessed
MailItemsAccessed
Office 365 Management Activity APIE5 / Audit Premium
将这些操作映射到 SIEM 的表或索引。有关数据摄取的具体信息，请参阅相应的平台 skill（
microsoft-sentinel
、
splunk-spl-processing
等）。

10. Quality checklist

10. 质量检查清单

  • Forwarding detection covers all mechanisms (inbox rules, SMTP forwarding, transport rules, Power Automate).
  • OAuth consent detections distinguish application vs delegated permissions.
  • MailItemsAccessed detections check 
    MailAccessType
    (Bind vs Sync) and 
    ClientInfoString
    .
  • SharePoint sharing detections distinguish anonymous links from authenticated sharing.
  • BEC detection chains correlate sign-in anomaly → mailbox manipulation → financial indicators.
  • UAL latency (60-90 min) accounted for in near-real-time detection design.
  • Audit Premium / E5 requirements declared for MailItemsAccessed detections.
  • Teams guest access and app installation monitored.
  • Bulk download/sync thresholds documented with rationale.
  • Transport rule and journal rule creation monitored as admin-level persistence.
  • 转发检测覆盖所有机制（收件箱规则、SMTP 转发、传输规则、Power Automate）。
  • OAuth consent 检测能够区分应用程序权限与 delegated 权限。
  • MailItemsAccessed 检测会检查 
    MailAccessType
    （Bind 与 Sync）以及 
    ClientInfoString
    。
  • SharePoint 共享检测能够区分匿名链接与经过身份验证的共享。
  • BEC 检测链能够关联登录异常 → 邮箱操纵 → 财务指标。
  • 近实时检测设计中已考虑 UAL 延迟（60–90 分钟）。
  • 已明确 MailItemsAccessed 检测对 Audit Premium / E5 的要求。
  • 已监控 Teams 来宾访问和应用安装。
  • 已记录批量下载/同步阈值及其设定依据。
  • 已将传输规则和 Journal 规则创建作为管理员级持久化行为进行监控。