Microsoft 365 Default or Anonymous user permissions added to mailbox folder

microsoft-365

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a user adds Default or Anonymous user permissions for a mailbox folder.

Strategy

Monitor Microsoft 365 audit logs to look for the operation Add-MailboxFolderPermission or Set-MailboxFolderPermission. These operations grant or modify permissions to specific mailbox folders like inbox. An attacker may grant folder access to the Default or Anonymous user permission allowing them to maintain persistence to the target user’s mail folders.

Note:

  • Default - references any internal, authenticated users.
  • Anonymous - references any external, unauthenticated users.

Triage and response

  1. Determine if there is a legitimate use case for adding Default or Anonymous permissions by contacting the user {{@usr.email}}.
  2. If {{@usr.email}} is not aware of the action:
    • Investigate other activities performed by users at the following attributes @usr.email and @Parameters.Identity using the Cloud SIEM - User Investigation dashboard.
    • Begin your organization’s incident response process and investigate.

Changelog

  • 17 August 2023 - Updated query to replace attribute @threat_intel.results.subcategory:tor with @threat_intel.results.category:tor.