Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
45 detections
Filters
Last updated
All Time
Detection languages
27
7
5
2
1
Contributors
9
8
7
6
5
Categories
37
16
15
8
5
Platforms
32
12
10
9
2
Products / Services
31
11
8
6
5
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies instances where read permissions are assigned to mailbox folders within an Office 365 environment. It leverages the `o365_management_activity` data source, specifically monitoring the `ModifyFolderPermissions` and `AddFolderPermissions` operations, while excluding Calendar, Contacts, and PersonMetadata objects. This activity is significant as unauthorized read permissions can lead to data exposure and potential information leakage. If confirmed malicious, an attacker could gain unauthorized access to sensitive emails, leading to data breaches and compromising the confidentiality of organizational communications.
The analytic detects the assignment of the ApplicationImpersonation role in Office 365 to a user or application. This role allows impersonation of any user, enabling access to and modification of their mailbox. If confirmed malicious, an attacker could gain unauthorized access to sensitive information, manipulate mailbox data, and perform actions as a legitimate user, posing a severe security risk to the organization.
The following analytic identifies instances where read permissions are granted to mailbox folders within an Office 365 environment. It detects this activity by monitoring the `o365_management_activity` data source for the `Set-MailboxFolderPermission` and `Add-MailboxFolderPermission` operations. This behavior is significant as it may indicate unauthorized access or changes to mailbox folder permissions, potentially exposing sensitive email content. If confirmed malicious, an attacker could gain unauthorized access to read email communications, leading to data breaches or information leakage.
Page 3 of 3