Analytics BIOC Informational
✕

Exchange mailbox folder permission modification

A user modified permissions to an Exchange mailbox folder.

Module:
Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security
Licensed by:
Identity Threat Detection (ITDR)
Licensed by:
Email Security
Data source:
Office 365 Audit
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation: Additional Email Delegate Permissions (T1098.002)
Attacker's goals:

An attacker may add permissions to a mailbox folder for persistence reasons. For instance, an attacker may assign the Default or Anonymous user permissions. This will allow them to maintain persistent access to the mailbox folder, which may lead to exfiltration of the messages.

Investigative actions:

Look for signs that the user account and mailbox are compromised (e.g. abnormal logins, unusual activity). Investigate the IP address associated with the activity. Follow further actions done by the account. Look for unusual email patterns from the affected mailbox (e.g. unusual email contents). Check for abnormal Azure AD non-interactive logins by the user. Monitor for changes that may indicate excessively broad permissions.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Exchange mailbox folder permission modification for a default user Low (parent: Informational)