SOP-40: Zero-Hour Auto Purge ZAP Triggered Response

Rudra Verma, Senior Security Architect & Researcher · 2026-07-18

Zero-Hour Auto Purge (ZAP) is Microsoft Defender for Office 365's mechanism for retroactively removing emails that were delivered before a threat verdict was available. ZAP fires when a newly discovered malware signature or URL reputation matches a message already in a user's mailbox. A ZAP event confirms that a malicious email was briefly accessible to the user — the key investigation question is whether the user interacted with it before ZAP ran.

ZAP coverage: malware ZAP and phish ZAP are enabled by default. Spam ZAP is configurable. ZAP does not apply to messages in Sent or custom folders — only Inbox and Deleted Items.

☰ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation

🛠

01 — BACKGROUND

TECHNIQUE OVERVIEW

Zero-Hour Auto Purge Architecture

T1566 — Phishing

ZAP works retrospectively: after an email is delivered, Defender continuously re-evaluates it against updated threat intelligence. When a verdict changes from clean to malicious, ZAP automatically moves the email to the user's Deleted Items folder. The ZAP window is up to 48 hours post-delivery. Key risk: between the delivery time and the ZAP action, the user had access to the malicious email and may have clicked a link or opened an attachment.

Field	Value
MITRE Technique	T1566 — Phishing (all subtypes)
Log Sources	EmailEvents, SecurityAlert, OfficeActivity (MailItemsAccessed)
ZAP Action Values	ZappedToJunk, ZappedToDelete, ZappedToQuarantine
ZAP Window	Up to 48 hours post-delivery (malware), 7 days (phish)
Detection Priority	HIGH if MailItemsAccessed confirms user read the email before ZAP

🔍

02 — IDENTIFICATION

2 INDICATORS

▶ Investigation Workflow

ZAP Action Verification & Pre-ZAP Access Detection

T1566

WHY CHECK

ZAP logs its action in EmailEvents as a LatestDeliveryAction update. OfficeActivity logs MailItemsAccessed events when a user opens, reads, or syncs an email via Outlook or mobile client. Comparing the MailItemsAccessed timestamp against the ZAP action timestamp determines whether the user read the malicious email before it was purged.

📍 Portal Navigation — Defender XDR Advanced Hunting

security.microsoft.com› Hunting› Advanced Hunting

1Navigate to Advanced Hunting. Replace NETWORK_MESSAGE_ID with the message ID from the ZAP alert.
2Run the first KQL to confirm ZAP completed successfully — LatestDeliveryAction should be ZappedToDelete or ZappedToJunk.
3Run the second KQL (OfficeActivity) to check if MailItemsAccessed fired before the ZAP timestamp — this confirms the user opened the email.
4If the user opened the email, check the email content: was it a phishing link or a malware attachment? Cross-reference with the threat verdict in Threat Explorer.
5Identify all recipients in the same ZAP action (campaign) by searching EmailEvents for the same sender and same ZAP action time window.

LatestDeliveryAction	Meaning	Action
ZappedToDelete	Email moved to Deleted Items — ZAP completed, check pre-ZAP access	Check MailItemsAccessed
ZappedToJunk	Email moved to Junk folder — ZAP completed	Check MailItemsAccessed
ZappedToQuarantine	Email quarantined — strongest ZAP action, typically malware verdict	Check MailItemsAccessed
Delivered (no change)	ZAP did not fire or failed — email still in inbox	Manual ZAP required

DETECTS: ZAP actions in EmailEvents — confirms ZAP completed and identifies all recipients affected. Use the NetworkMessageId from the security alert.

KQL — Defender XDR Advanced Hunting (EmailEvents — ZAP Confirmation)

EmailEvents | where Timestamp > ago(48h) | where NetworkMessageId == "NETWORK_MESSAGE_ID" or LatestDeliveryAction startswith "Zapped" | project Timestamp, RecipientEmailAddress, SenderFromAddress, Subject, DeliveryAction, LatestDeliveryAction, LatestDeliveryLocation, ThreatTypes | order by Timestamp desc

DETECTS: Whether the user accessed the email before ZAP removed it — MailItemsAccessed events occurring between email delivery and ZAP action timestamp confirm user interaction with the malicious message.

KQL — Microsoft Sentinel (OfficeActivity — Pre-ZAP Access)

DETECTS: ZAP activity in Splunk O365 audit logs — identifies emails retroactively moved by ZAP and cross-references with mailbox access events to determine pre-ZAP user interaction.

SPL — Splunk

index=* sourcetype=ms_o365_management_activity (ResultStatus="ZappedToDelete" OR ResultStatus="ZappedToJunk") | stats count as zap_count, values(AffectedItems{}.Subject) as subjects, values(UserId) as affected_users by SenderAddress ThreatType | sort -zap_count

Campaign Scope & Endpoint Triage

T1566

WHY CHECK

ZAP events often represent campaign-level detections where the same malicious sender or attachment hash targeted multiple users. Scoping the campaign reveals the full blast radius and identifies whether any user opened a malicious link or attachment before ZAP fired, requiring endpoint triage on their device.

📍 Portal Navigation — Defender XDR Threat Explorer

security.microsoft.com› Email & Collaboration› Explorer → All email

1In Threat Explorer → All email, filter by Sender and the ZAP alert's sender domain. Set time range to Last 48 hours.
2Review all emails from this sender — note which recipients received emails and which had ZAP applied. Check the URL clicks column for any Safe Links detonations.
3For any user whose device shows a URL click or MailItemsAccessed before ZAP, navigate to their device in Assets → Devices and review the Timeline for suspicious process activity.
4Run the KQL below to find all users in the campaign scope and whether they had pre-ZAP email access.
5If a URL was clicked, check whether Safe Links blocked it or allowed it — if allowed, treat as potential malware delivery and triage the endpoint.

DETECTS: Full campaign scope — all recipients of emails from the flagged sender with ZAP actions applied. Identifies users at risk and whether the threat type was malware or phishing.

KQL — Defender XDR Advanced Hunting (Campaign Scope)

EmailEvents | where Timestamp > ago(48h) | where SenderFromDomain == "SENDER_DOMAIN" and LatestDeliveryAction startswith "Zapped" | summarize ZapCount = count(), Recipients = make_set(RecipientEmailAddress), Subjects = make_set(Subject, 5), ThreatTypes = make_set(ThreatTypes) by SenderFromAddress, LatestDeliveryAction

If the ZAP verdict is Malware and any user opened the email before ZAP fired, automatically treat it as a potential malware execution scenario and trigger endpoint triage per SOP-38 (Malware Email Attachment Response). Do not wait for confirmation before starting the endpoint check.

🚫

03 — CONTAINMENT

IMMEDIATE ACTION

Verdict & Escalation Decision

DECISION GATE

▶ Triage Verdict — Select One

CONFIRMED MailItemsAccessed before ZAP timestamp AND malware verdict → Triage endpoint per SOP-38, isolate if execution confirmed

PARTIAL Campaign: multiple ZAP'd recipients, some with pre-ZAP access, phish verdict → Contact exposed users, check URL clicks, monitor endpoints 24h

FALSE POSITIVE ZAP fired but threat verdict later overturned (false positive remediation) → Request email restoration from quarantine, document reversal

Manual ZAP & Sender Block

CONTAINMENT

1If automatic ZAP did not fire or missed copies, manually purge: Threat Explorer → All email → filter by sender → Actions → Move to deleted items.
2Block the sender domain and IP in Threat Policies → Anti-spam → Block list.
3For users who accessed the email pre-ZAP: notify them directly, instruct them not to click any links in Deleted Items, and initiate endpoint monitoring.
4For phishing ZAP: check if any URL clicks were logged in UrlClickEvents and whether Safe Links blocked or allowed the destination URL.

🗑

04 — ERADICATION

CLEANUP

Confirm Purge & Harden Policy

ERADICATION

1Re-run the EmailEvents KQL to confirm LatestDeliveryAction for all impacted messages shows a Zapped status. No email should remain in Delivered state from the flagged sender.
2If ZAP moved emails to Deleted Items (not Quarantine), also purge from Deleted Items: Threat Explorer → Actions → Move to quarantine for the most sensitive cases.
3Review ZAP policy configuration: Threat Policies → Anti-malware / Anti-phishing — confirm ZAP is enabled for Malware (Enabled), Phish (Enabled), and Spam (Enabled).
4Verify Safe Links is configured to re-scan links at click time (Apply real-time URL scanning = On) so phishing URLs are caught even if the email was read before ZAP.

Eradication Complete When

All ZAP'd emails confirmed in Deleted Items or Quarantine
Sender blocked at anti-spam level
All exposed users (pre-ZAP access) contacted and endpoints checked
ZAP policy confirmed enabled for Malware, Phish, and Spam
Safe Links real-time URL scanning confirmed active

📢

05 — ESCALATION

ESCALATION PATHS

ES1

Escalation Matrix

ESCALATION

Condition	Severity	Action	Notify
Malware ZAP + pre-ZAP access confirmed	SEV1	Endpoint triage per SOP-38, isolate if executed	SOC Lead → CISO → IR Team
Phish ZAP + URL click confirmed	SEV2	Check credential harvest, reset user password	SOC Lead → IT Security
Campaign: 10+ recipients ZAP'd	SEV2	Org-wide comms, check all exposed endpoints	SOC Lead → IT Manager
Single user, ZAP successful, no interaction	SEV4	Document, block sender, close ticket	Ticket only

Stay Threat-Ready

Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.

📺 YouTube 🎤 TikTok 🐦 X / Twitter 📡 Telegram

All SOPs Blog Web App (Free)

They can't exploit you if you are the Exploit.