Link Search Menu Expand Document

O365_Exchange_SetMailBox_GrantSendOnBehalf_External

ID: 100438

Description:

Set-Mailbox GrantSendOnBehalf on an Exchange Mailbox External Address - KLK - This behavior identifies a case where the Grant SendOnBehalf permission has been set to an address that is external to the domain. For example, an external user has the ability to send e-mail on behalf of a domain user. This also identifies when multiple SendOnBehalf operations have been set (multiple mailboxes).

Repository: Group: Office365 Type: event

Default Status:

Enabled

Tags:      
O365 Office Exchange Mailbox
       
       

Selector:

Query:

Filters:

Standard:

Field MUST hit
@fields.Operation Set-Mailbox
@fields.Workload Exchange
Field MUST NOT hit
@fields.ExternalAccess false

Additional JSON:

function json_doc_filter (doc)
   for i,v in ipairs(doc['@fields'].Parameters)
   do
      
      print(v.Name .. ": " .. v.Value)
      if v.Name == "GrantSendOnBehalfTo" then
         return true
      end
   end
   return false
end
return json_doc_filter

Behavior Rule:

Key Type Behavior Category
@fields.UserId username application activity

Risks:

Risks Base Score Dimension
ALERT_NORMAL 100 alert

Attributes:

Alias Key
IP @fields.ClientIP
ObjectId @fields.ObjectId
Operation @fields.Operation
ISP @fields._ip.isp
City @fields._ip.city
Country @fields._ip.country
UserId @fields.UserId
ExternalAccess @fields.ExternalAccess
GrantTo @fields.ParametersFields.GrantSendOnBehalfTo

Correlation Rules:

Aggregation:

Name Window Field AggType Match
MultipleMailboxes 1 day @fields.ObjectId cardinality gt 1
  Risks: ALERT_NORMAL    

First Occurrence:

Name Window Fields
NewUser 10 days @fields.UserId
  Risks: ML_NEW_USER
NewTarget 10 days @fields.ObjectId
  Risks: ML_NEW_USER
NewISP 10 days @fields._ip.isp
  Risks: SUSPICIOUS_GEO

History:

User Date
ke*y@fluencysecurity.com 2021 Aug 16 07:07:46 EDT
ke*y@fluencysecurity.com 2021 Aug 27 08:14:03 EDT
ke*y@fluencysecurity.com 2021 Aug 27 08:14:17 EDT
ke*y@fluencysecurity.com 2021 Aug 27 08:16:24 EDT

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)