Exchange mailbox delegation permissions added

Cortex XDR Analytics Alert Reference by Alert name

Product
Cortex XDR
Last date published
2024-06-18
Category
Analytics Alert Reference
Order
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

4 Hours

Deduplication Period

1 Day

Required Data

  • Requires:
    • Office 365 Audit

Detection Modules

Identity Threat Module

ATT&CK Tactic

Persistence (TA0003)

ATT&CK Technique

Account Manipulation: Additional Email Delegate Permissions (T1098.002)

Severity

Informational

Description

A user added delegation permissions to an Exchange mailbox.

Attacker's Goals

Add delegation permissions to a mailbox for persistence reasons.

Investigative actions

  • Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
  • Investigate the IP address associated with the activity.
  • Follow further actions done by the account.
  • Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).

Variations

Addition of Exchange mailbox delegation permissions with suspicious characteristics

Synopsis

ATT&CK Tactic

Persistence (TA0003)

ATT&CK Technique

Account Manipulation: Additional Email Delegate Permissions (T1098.002)

Severity

Low

Description

A user added delegation permissions to an Exchange mailbox.

Attacker's Goals

Add delegation permissions to a mailbox for persistence reasons.

Investigative actions

  • Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
  • Investigate the IP address associated with the activity.
  • Follow further actions done by the account.
  • Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).