Forum Discussion

mlapierre's avatar
mlapierre
Copper Contributor
Dec 12, 2024

How to automaticaly block a user's account to send spam when an account takepver occurs.

 

Hi,

 

Our organisation use MS 365 Exchange online sync with an on premise DC on Win Server 2019

Recently we got 2 accounts takeover which result thousands spam send by thoses accounts.
I wonder if there is a way in Defender to set a rule saying for exemple that "if a user send 10 emails with the same object to 10 differents address in 1 minute, lock the account".

This would prevent that the account send thousands mails before I could manually locked it.

I checked on Microsoft learn. but didnt fin a way to acheive that.

There is any way to do it?

Thanks.

 

  • ArthurS1790's avatar
    ArthurS1790
    Copper Contributor

    cpu slows down after spam detection automatically. Preform user log in.

Resources