Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a user adds Default or Anonymous user permissions for a mailbox folder.

Strategy

Monitor Microsoft 365 audit logs to look for the operation Add-MailboxFolderPermission or Set-MailboxFolderPermission. These operations grant or modify permissions to specific mailbox folders like inbox. An attacker may grant folder access to the Default or Anonymous user permission allowing them to maintain persistence to the target user’s mail folders.

Note:

• Default - references any internal, authenticated users.
• Anonymous - references any external, unauthenticated users.

Triage and response

1. Determine if there is a legitimate use case for adding Default or Anonymous permissions by contacting the user {{@usr.email}}.
2. If {{@usr.email}} is not aware of the action:
   • Investigate other activities performed by users at the following attributes @usr.email and @Parameters.Identity using the Cloud SIEM - User Investigation dashboard.
   • Begin your organization’s incident response process and investigate.

Changelog

• 17 August 2023 - Updated query to replace attribute @threat_intel.results.subcategory:tor with @threat_intel.results.category:tor.