Analytics BIOC
Medium
✕
Mailbox Client Access Setting (CAS) changed
An attacker may use PowerShell to change the Client Access Settings (CAS) for a mailbox, hence gaining access to the data.
- Module:
- Platform Analytics
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
Attacker's goals:
Gain access to the data in the compromised mailbox.
Investigative actions:
Examine the PowerShell command to identify which mailbox's access setting has been modified. Verify that the change in the client access setting was executed by a trusted source.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day