VIP Mailbox manipulation

id: 5170c3c4-b8c9-485c-910d-a21d965ee181
name: VIP Mailbox manipulation
description: |
  'Alert if a cmdlet that can be translated to data exfiltration or mailbox access is executed on a VIP Mailbox.'
requiredDataConnectors:
  - connectorId: ESI-ExchangeAdminAuditLogEvents
    dataTypes:
      - Event
severity: Medium
queryFrequency: 30m
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - Exfiltration
  - Persistence
  - Collection
relevantTechniques:
  - T1020
  - T1098
  - T1114
query: |
  let VIPRestriction = "on";
  ExchangeAdminAuditLogs
  | where IsVIP or VIPRestriction =~ "off"
  | where UserOriented =~ 'Yes' and IsSensitive and ((IsRestrictedCmdLet and IsSenstiveCmdletParameters) or IsRestrictedCmdLet == false)
  | extend Level = iif (Status == "Failure", "Medium", "High")
entityMappings:
- entityType: Mailbox
  fieldMappings:
    - identifier: MailboxPrimaryAddress
      columnName: TargetObject
- entityType: Host
  fieldMappings:
    - identifier: FullName
      columnName: Computer
- entityType: Account
  fieldMappings:
    - identifier: Sid
      columnName: TargetObject
    - identifier: ObjectGuid
      columnName: TargetObject
    - identifier: FullName
      columnName: TargetObject
- entityType: Account
  fieldMappings:
    - identifier: Name
      columnName: Caller
alertDetailsOverride:
  alertDisplayNameFormat: "{{CmdletName}} executed on {{TargetObject}}"
  alertDescriptionFormat: "Alert from Microsoft Exchange Security as {{CmdletName}} with parameters {{CmdletParameters}} was executed on {{TargetObject}}"
  alertSeverityColumnName: Level 
version: 1.2.0
kind: Scheduled