O365_Exchange_SetMailBox_GrantSendOnBehalf_External

ID: 100438

Description:

Set-Mailbox GrantSendOnBehalf on an Exchange Mailbox External Address - KLK - This behavior identifies a case where the Grant SendOnBehalf permission has been set to an address that is external to the domain. For example, an external user has the ability to send e-mail on behalf of a domain user. This also identifies when multiple SendOnBehalf operations have been set (multiple mailboxes).

Repository: Fluency Group: Office365 Type: event

Default Status:

Enabled

Selector:

Query:

Filters:

Standard:

Additional JSON:

function json_doc_filter (doc)
   for i,v in ipairs(doc['@fields'].Parameters)
   do
      
      print(v.Name .. ": " .. v.Value)
      if v.Name == "GrantSendOnBehalfTo" then
         return true
      end
   end
   return false
end
return json_doc_filter

Behavior Rule:

Risks:

Attributes:

Correlation Rules:

Aggregation:

First Occurrence:

History:

This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)