Exchange mailbox delegation permissions added

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-11-18

Activation Period	14 Days
Training Period	30 Days
Test Period	4 Hours
Deduplication Period	1 Day
Required Data	Requires: Office 365 Audit
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation: Additional Email Delegate Permissions (T1098.002)
Severity	Informational

A user added delegation permissions to an Exchange mailbox.

Add delegation permissions to a mailbox for persistence reasons.

Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
Investigate the IP address associated with the activity.
Follow further actions done by the account.
Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation: Additional Email Delegate Permissions (T1098.002)
Severity	Low

A user added delegation permissions to an Exchange mailbox.

Add delegation permissions to a mailbox for persistence reasons.

Look for signs that the user account and mailboxes are compromised (e.g. abnormal logins, unusual activity).
Investigate the IP address associated with the activity.
Follow further actions done by the account.
Look for unusual email patterns from the affected mailbox (e.g. unusual email contents).