Exchange anti-phish policy disabled or removed

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Office 365 Audit
Detection Modules	Identity Threat Module
ATT&CK Tactic	Defense Evasion (TA0005) Initial Access (TA0001)
ATT&CK Technique	Impair Defenses: Disable or Modify Tools (T1562.001) Phishing (T1566)
Severity	Low

A user disabled or removed an Exchange anti-phish policy, which may indicate evasion of a possible phishing campaign.

An attacker is attempting to evade detection.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

A user disabled or removed an Exchange anti-phish policy, which may indicate evasion of a possible phishing campaign.

An attacker is attempting to evade detection.