Exchange mailbox delegation permissions added

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	4 Hours
Deduplication Period	1 Day
Required Data	Office 365 Audit
Detection Modules	Identity Threat Module, SaaS Threat Detection, Email
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation: Additional Email Delegate Permissions (T1098.002)
Severity	Informational

Description

A user added delegation permissions to an Exchange mailbox.

Attacker's Goals

Add delegation permissions to a mailbox for persistence reasons.

Investigative actions

• Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
• Investigate the IP address associated with the activity.
• Follow further actions done by the account.
• Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).

Variations

Addition of Exchange mailbox delegation permissions with suspicious characteristics

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation: Additional Email Delegate Permissions (T1098.002)
Severity	Low

Description

A user added delegation permissions to an Exchange mailbox.

Attacker's Goals

Add delegation permissions to a mailbox for persistence reasons.

Investigative actions

• Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
• Investigate the IP address associated with the activity.
• Follow further actions done by the account.
• Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).