Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Identity Threat Module |
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Low |
Description
A user disabled an Exchange Safe Attachment policy, which provides phishing protection to email attachments.
Attacker's Goals
An attacker may attempt to disable the Safe Attachment policy to evade detection.
Investigative actions
- Follow further actions done by the account.
- Verify that the configuration change was expected.
- Check for a possible phishing campaign on the organization.