
Summary
This detection rule monitors changes in the read permissions of mailbox folders within an Office 365 environment. Specifically, it looks for operations performed with `Set-MailboxFolderPermission` and `Add-MailboxFolderPermission` in the `o365_management_activity` data source. The rule targets access rights associated with reading emails, such as `ReadItems`, `Author`, `NonEditingAuthor`, `Owner`, `PublishingAuthor`, and `Reviewer`. Such changes in permissions could indicate unauthorized access or potential malicious activity, leading to data exfiltration or breaches. By capturing instances where read access is granted, this detection serves as an essential alert mechanism to identify possible compromises in user mailboxes.
Categories
- Cloud
- Identity Management
- Web
Data Sources
- Cloud Service
- User Account
- Application Log
ATT&CK Techniques
- T1098
- T1098.002
Created: 2024-11-14