O365 Elevated Mailbox Permission Assigned

name: O365 Elevated Mailbox Permission Assigned
id: 2246c142-a678-45f8-8546-aaed7e0efd30
version: 13
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Patrick Bareiss, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies the assignment of elevated mailbox permissions in an Office 365 environment via the Add-MailboxPermission operation. It leverages logs from the Exchange workload in the o365_management_activity data source, focusing on permissions such as FullAccess, ChangePermission, or ChangeOwner. This activity is significant as it indicates potential unauthorized access or control over mailboxes, which could lead to data exfiltration or privilege escalation. If confirmed malicious, attackers could gain extensive access to sensitive email data and potentially manipulate mailbox settings, posing a severe security risk.
data_source:
    - O365 Add-MailboxPermission
search: |-
    `o365_management_activity` Workload=Exchange Operation=Add-MailboxPermission (AccessRights=FullAccess OR AccessRights=ChangePermission OR AccessRights=ChangeOwner)
      | rename Identity AS dest_user
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           src vendor_account vendor_product
           dest_user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_elevated_mailbox_permission_assigned_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: FullAccess mailbox delegation may be assigned for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1098/002/
    - https://learn.microsoft.com/en-us/powershell/module/exchange/add-mailboxpermission
    - https://learn.microsoft.com/en-us/exchange/recipients/mailbox-permissions?view=exchserver-2019
finding:
    title: Elevated mailbox permissions were assigned on $dest_user$
    entity:
        field: dest_user
        type: user
        score: 50
analytic_story:
    - Office 365 Collection Techniques
asset_type: O365 Tenant
mitre_attack_id:
    - T1098.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: audit