Microsoft 365 Default or Anonymous user permissions added to mailbox folder

microsoft-365

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when a user adds Default or Anonymous user permissions for a mailbox folder.

Strategy

Monitor Microsoft 365 audit logs to look for the operation Add-MailboxFolderPermission or Set-MailboxFolderPermission. These operations grant or modify permissions to specific mailbox folders like inbox. An attacker may grant folder access to the Default or Anonymous user permission allowing them to maintain persistence to the target user’s mail folders.

Note:

  • Default - references any internal, authenticated users.
  • Anonymous - references any external, unauthenticated users.

Triage and response

  1. Determine if there is a legitimate use case for adding Default or Anonymous permissions by contacting the user {{@usr.email}}.
  2. If {{@usr.email}} is not aware of the action:
    • Investigate other activities performed by users at the following attributes @usr.email and @Parameters.Identity using the Cloud SIEM - User Investigation dashboard.
    • Begin your organization’s incident response process and investigate.

Changelog

  • 17 August 2023 - Updated query to replace attribute @threat_intel.results.subcategory:tor with @threat_intel.results.category:tor.