Exchange DKIM signing configuration disabled

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Office 365 Audit
Detection Modules	Identity Threat Module, SaaS Threat Detection, Email
ATT&CK Tactic	Initial Access (TA0001), Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Phishing (T1566)
Severity	Low

Description

A user disabled an Exchange DomainKeys Identified Mail (DKIM) signing configuration. DKIM helps ensure that emails are authorized and not spoofed.

Attacker's Goals

An attacker is attempting to evade detection.

Investigative actions

• Follow further actions done by the account.
• Verify that the configuration change was expected.
• Check for a possible phishing campaign on the organization.

Variations

A recently configured Exchange DKIM signing configuration was disabled

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001), Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Phishing (T1566)
Severity	Informational

Description

A user disabled an Exchange DomainKeys Identified Mail (DKIM) signing configuration. DKIM helps ensure that emails are authorized and not spoofed.

Attacker's Goals

An attacker is attempting to evade detection.

Investigative actions

• Follow further actions done by the account.
• Verify that the configuration change was expected.
• Check for a possible phishing campaign on the organization.