Mailbox-Level Detection

What mailbox-level detection is trying to catch

Mailbox-level detection focuses on the activity that happens inside a single email account, rather than only on perimeter filters or broad tenant alerts. It is aimed at the behavioural signs of compromise that show up after an attacker, phisher, or insider has access to the mailbox.

The value of this approach is that many email compromises do not look unusual at first glance from the outside. A mailbox can still send, receive, and authenticate normally while quietly being used to read sensitive messages, hide evidence, or redirect future mail.

Signals inside the mailbox

Effective mailbox-level monitoring usually looks for changes in message flow, inbox rules, forwarding destinations, deleted items, delegated access, and suspicious sign-in behaviour. It also watches for patterns such as a sudden burst of mail access, access from unfamiliar locations, or rule changes that preserve attacker visibility after takeover.

These signals matter because they often indicate that the mailbox itself has become part of the attack path. A forwarding rule can turn a one-time breach into ongoing surveillance, while inbox manipulation can bury security alerts, invoice requests, or password reset messages that would otherwise expose the compromise.

Why mailbox-level detection matters for security operations

Mailbox-level detection is a detection and response capability, not just an email hygiene control. It helps security teams distinguish between routine user behaviour and mailbox abuse that may require containment, investigation, and account recovery.

It also improves visibility into attacks that use legitimate access rather than obvious malware. Once an attacker is inside a mailbox, they can often operate through normal mail functions, which makes mailbox telemetry valuable for spotting persistence, reconnaissance, and misuse before broader damage occurs.

How mailbox-level detection is used in practice

In practice, mailbox-level detection works best when it is connected to identity, sign-in, and message telemetry so investigators can correlate mailbox events with account compromise indicators. MITRE D3FEND is useful here because it frames defensive monitoring and containment as linked countermeasures, not isolated alerts.

Security teams also use mailbox-level findings to drive triage, user containment, and post-incident review. SANS Security Resources is a practical reference point for detection engineering and incident handling patterns that apply well to mailbox abuse investigations.

Mailbox-level detection is strongest when it feeds a broader investigation, not when it is treated as a standalone alert source. The key question is whether mailbox behaviour shows evidence of access that should not have existed, continued access that should have been revoked, or rules and forwarding paths that preserve attacker control.

Risk and Threat Considerations

Mailbox-level detection addresses a high-value abuse surface because email remains both a communication channel and an identity-adjacent control point. When an attacker controls a mailbox, they can observe business communications, intercept reset messages, and maintain persistence through quiet rule changes or forwarding abuse.

Failure mechanism: The mailbox is compromised, but the compromise is hidden behind normal mail usage, so malicious access continues through rules, forwarding, delegated access, or routine sign-ins that do not immediately look suspicious.

Impact: Organisations can lose confidentiality of messages, miss signs of account takeover, and allow phishing persistence or insider misuse to continue long enough to affect fraud, lateral access, or further identity compromise.

Practitioner Guidance

What to watch for: Treat mailbox rule creation, forwarding changes, unusual read patterns, and access from unexpected geographies or devices as investigation triggers, especially when they coincide with password resets or MFA fatigue events. Mailbox telemetry is most useful when analysts can compare it against the user’s normal communication pattern and recent authentication history.

Governance implication: Mailbox-level detection should have clear ownership across email security, SOC, and identity operations, because effective response often requires both containment of the mailbox and review of the associated account lifecycle. Practitioners should define when to suspend access, when to reset credentials, and when to invalidate existing sessions or tokens after suspicious mailbox activity.

Related resources from NHI Mgmt Group

• How can organisations measure whether technique-level detection is working?
• Why do technique-level detection scores often overstate real coverage?
• How can organisations tell whether session-level detection is actually working?
• What breaks when security teams rely only on technique-level mappings in threat detection programmes?