Link Search Menu Expand Document

O365_Exchange_SetMailBox_GrantSendOnBehalf

ID: 100223

Description:

Set-Mailbox GrantSendOnBehalf on an Exchange Mailbox - KLK

Repository: Fluency Group: Office365 Type: event

Default Status:

Enabled

Tags:      
O365 Office Exchange Mailbox
       
       

Selector:

Query:

Filters:

Standard:

Field MUST hit
@fields.Operation Set-Mailbox
@fields.Workload Exchange
Field MUST NOT hit
   

Additional JSON:

function json_doc_filter (doc)
   for i,v in ipairs(doc['@fields'].Parameters)
   do
      
      print(v.Name .. ": " .. v.Value)
      if v.Name == "GrantSendOnBehalfTo" then
         return true
      end
   end
   return false
end
return json_doc_filter

Behavior Rule:

Key Type Behavior Category
@fields.UserId username application activity

Risks:

Risks Base Score Dimension
ALERT_NORMAL 100 alert

Attributes:

Alias Key
IP @fields.ClientIP
ObjectId @fields.ObjectId
Operation @fields.Operation
ISP @fields._ip.isp
City @fields._ip.city
Country @fields._ip.country
UserId @fields.UserId
ExternalAccess @fields.ExternalAccess
GrantTo @fields.ParametersFields.GrantSendOnBehalfTo

Correlation Rules:

Aggregation:

Name Window Field AggType Match
MultipleMailboxes 1 day @fields.ObjectId cardinality gt 1
  Risks: ALERT_NORMAL    

First Occurrence:

Name Window Fields
NewUser 10 days @fields.UserId
  Risks: ML_NEW_USER
NewTarget 10 days @fields.ObjectId
  Risks: ML_NEW_USER
NewISP 10 days @fields._ip.isp
  Risks: SUSPICIOUS_GEO

History:

User Date
ke*y@fluencysecurity.com 2021 Mar 30 04:28:40 EDT
ke*y@fluencysecurity.com 2021 Mar 30 08:26:39 EDT
2021 Apr 6 11:21:01 EDT
ke*y@fluencysecurity.com 2021 Jun 24 10:23:36 EDT
em*n@fluencysecurity.com 2021 Jul 7 17:12:15 EDT
ho*d@fluencysecurity.com 2021 Aug 4 08:49:43 EDT
ho*d@fluencysecurity.com 2021 Aug 4 08:56:09 EDT
ho*d@fluencysecurity.com 2021 Aug 11 16:02:40 EDT

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)