Microsoft 365 SendAs permissions added
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when a user adds SendAs permissions.
Strategy
Monitor Microsoft 365 audit logs to look for the operation Add-RecipientPermission. SendAs permission allows a user or group members to send messages that appear to come from the specified mailbox, mail contact, mail user, or group. Attackers may configure this to allow them to impersonate a user and send messages on their behalf from their mailbox, allowing the attacker to persist in the organization or move laterally by phishing other users.
Triage and response
- Inspect the
@Parameters.Trustee field to determine if the email address is external to your organization. - Determine if there is a legitimate use case for adding SendAs permissions by contacting the user
{{@usr.email}}. - If
{{@usr.email}} is not aware of the action:- Investigate other activities performed by users at the following attributes
@usr.email, @Parameters.Trustee and @Parameters.Identity using the Cloud SIEM - User Investigation dashboard. - Begin your organization’s incident response process and investigate.
Changelog
- 17 August 2023 - Updated query to replace attribute
@threat_intel.results.subcategory:tor with @threat_intel.results.category:tor.
