Investigating mailbox access

Start with the mailbox questions

Which mailbox?

Identify the affected mailbox and the period of suspected access.

Which activity?

Look for mail access, forwarding, rule changes and relevant client or application activity.

Which data?

Determine the messages or folders identified in the evidence and assess the information they contain.

What MailItemsAccessed records

The Exchange audit operation MailItemsAccessed records access to mail data. It does not necessarily mean that a person opened and read an email on screen.

An event associated with attacker activity can help identify potentially exposed mail. Inspect its access type and identifiers before describing the scope.

Bind and Sync

Bind

Access to individual messages. Records can include InternetMessageId, an identifier that helps locate the email involved.

Sync

Synchronisation downloads mail data to an email application, such as Outlook. Review the Sync records and surrounding activity to assess what may have been exposed.

For each type, link the event to the account, IP, session, client and investigation period. A client name on its own does not establish that unauthorised synchronisation occurred.

Why local copies matter

A synchronising client can create a local copy of email. Removing account access does not retrieve information already copied to another device.

When Sync activity matches the attacker’s access context, Microsoft recommends treating the entire mailbox as compromised. This is an exposure assessment; it does not prove which messages the attacker later read offline.

Identify and assess the mail

Message identifiers

Use available InternetMessageId values to locate messages identified by Bind records.

Client and session context

Review the application or protocol, IP address, session and user to connect access to the compromise.

Sensitive content

Check whether potentially exposed messages contain personal information, financial details, attachments or other business-sensitive material.

Forwarding and delivery

Use rule details and message trace to investigate emails sent or forwarded outside the organisation.

Explain the limits of the evidence

Logging settings, licensing, retention and event aggregation affect what is available. If message-level records are missing, you may be able to establish mailbox access without identifying every message involved.

Describe what the records show, the scope of possible exposure and what remains uncertain. Accessing, downloading, forwarding and exporting email are different actions. Use the relevant evidence to establish which occurred.