Microsoft 365 Default or Anonymous user permissions added to mailbox folder
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when a user adds Default or Anonymous user permissions for a mailbox folder.
Strategy
Monitor Microsoft 365 audit logs to look for the operation Add-MailboxFolderPermission or Set-MailboxFolderPermission. These operations grant or modify permissions to specific mailbox folders like inbox. An attacker may grant folder access to the Default or Anonymous user permission allowing them to maintain persistence to the target user’s mail folders.
Note:
- Default - references any internal, authenticated users.
- Anonymous - references any external, unauthenticated users.
Triage and response
- Determine if there is a legitimate use case for adding Default or Anonymous permissions by contacting the user
{{@usr.email}}. - If
{{@usr.email}} is not aware of the action:- Investigate other activities performed by users at the following attributes
@usr.email and @Parameters.Identity using the Cloud SIEM - User Investigation dashboard. - Begin your organization’s incident response process and investigate.
Changelog
- 17 August 2023 - Updated query to replace attribute
@threat_intel.results.subcategory:tor with @threat_intel.results.category:tor.
