Link Search Menu Expand Document

O365_Exchange_RecipientPermission_SendAs

ID: 100222

Description:

Add-RecipientPermission SendAs on an Exchange Mailbox - KLK

Repository: Fluency Group: Office365 Type: event

Default Status:

Enabled

Tags:      
O365 Office Exchange Mailbox
       
       

Selector:

Query:

Filters:

Standard:

Field MUST hit
@fields.Operation Add-RecipientPermission
@fields.Workload Exchange
Field MUST NOT hit
   

Additional JSON:

function json_doc_filter (doc)
   for i,v in ipairs(doc['@fields'].Parameters)
   do
      
      print(v.Name .. ": " .. v.Value)
      if v.Name == "AccessRights" and v.Value == "SendAs" then
         return true
      end
   end
   return false
end
return json_doc_filter

Behavior Rule:

Key Type Behavior Category
@fields.UserId username application activity

Risks:

Risks Base Score Dimension
ALERT_NORMAL 100 alert

Attributes:

Alias Key
IP @fields.ClientIP
ObjectId @fields.ObjectId
Operation @fields.Operation
ISP @fields._ip.isp
City @fields._ip.city
Country @fields._ip.country
UserId @fields.UserId
ExternalAccess @fields.ExternalAccess
Identity @fields.ParametersFields.Identity
Trustee @fields.ParametersFields.Trustee
AccessRights @fields.ParametersFields.AccessRights
SubjetUsername @fields.SubjectUserName
TargetUsername @fields.TargetUserName
SubjectFullName @fields.SubjectFullName
TargetFullName @fields.TargetFullName

Correlation Rules:

Aggregation:

Name Window Field AggType Match
MultipleRecipients 1 day @fields.ObjectId cardinality gt 1
  Risks: ALERT_NORMAL    

First Occurrence:

Name Window Fields
NewTarget 10 days @fields.ObjectId
  Risks: ML_NEW_USER
NewUser 10 days @fields.UserId
  Risks: ML_NEW_USER
NewISP 10 days @fields._ip.isp
  Risks: SUSPICIOUS_GEO

History:

User Date
ke*y@fluencysecurity.com 2021 Mar 30 04:26:18 EDT
ke*y@fluencysecurity.com 2021 Mar 30 08:25:39 EDT
2021 Apr 6 11:17:43 EDT
2021 Apr 6 11:18:54 EDT
ke*y@fluencysecurity.com 2021 Jun 24 10:25:39 EDT
em*n@fluencysecurity.com 2021 Jul 6 23:52:45 EDT
ho*d@fluencysecurity.com 2021 Aug 11 15:44:48 EDT
ho*d@fluencysecurity.com 2021 Aug 11 16:02:10 EDT
ke*y@fluencysecurity.com 2021 Sep 13 06:17:15 EDT

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)