Detection of O365 Email Receive and Hard Delete Takeover Behavior

This threat involves the unauthorized manipulation of Microsoft Office 365 mailboxes by threat actors to facilitate financial fraud or maintain persistence. After gaining access to a user account, adversaries target sensitive incoming communications such as banking notifications, direct deposit updates, MFA requests, or password reset alerts. To avoid detection by the account owner, the actor performs a hard delete of these messages from the 'Sent Items' or 'Recoverable Items' folders. This behavior is a critical indicator of account takeover (ATO) and is often associated with payroll redirection scams. Defenders should monitor for the correlation between incoming messages containing sensitive keywords and subsequent mailbox management activities that bypass standard trash bin recovery paths.

Attack Chain

1. Attacker gains initial access to a user account (e.g., via phishing, session token theft, or credential stuffing).
2. Attacker configures mailbox access to monitor for sensitive communications.
3. Attacker intercepts or triggers an email related to payroll, MFA, or account recovery keywords.
4. Attacker performs the malicious action (e.g., redirects direct deposit or modifies security settings).
5. Attacker locates the confirmation or notification email within the inbox.
6. Attacker initiates an Exchange 'HardDelete' operation to remove the email from the 'Recoverable Items' or 'Sent Items' folders.
7. Attacker successfully obscures evidence of the unauthorized change, delaying victim detection.

Impact

Successful exploitation allows threat actors to perform unauthorized financial transactions, such as redirecting payroll payments to attacker-controlled accounts. The act of hard-deleting messages removes forensic evidence of the compromise, complicating incident response and recovery efforts.

Recommendation

Prioritize monitoring for anomalous mailbox operations that attempt to purge sensitive audit trails.

• Implement logging for 'HardDelete' operations in the Office 365 Universal Audit Log to detect potential evidence tampering.
• Correlate message trace data with mailbox management activity logs to identify the rapid succession of message receipt and deletion.
• Investigate user accounts flagged by these patterns for signs of unauthorized access, such as unexpected IP addresses or unusual User-Agent strings.