Exchange Mailbox Delegation Abuse via Add-MailboxPermission/RecipientPermission
This rule monitors for Exchange administration operations where mailbox permissions ('FullAccess', 'SendAs', or 'SendOnBehalf') are granted to a user. It specifically flags instances where the account performing the action is neither the owner of the target mailbox nor the grantee, identifying suspicious, potentially unauthorized delegation patterns.
Microsoft Sentinel (KQL)
