Security

Exchange Web Services (EWS)

A Microsoft API that lets applications read and send mail, calendar and contact data in Exchange and Microsoft 365. Attackers abuse it to harvest mailboxes programmatically using stolen credentials.

Deep dive

Learn Article

How to Spot DCSync and Mailbox Harvesting After a Web Server Is Breached

Credential replication and bulk email collection both abuse legitimate protocols, so detection means baselining normal activity and alerting on the exceptions.

intermediate 5 min read

Back to glossary