Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies Office operations that are typically rare and can provide capabilities useful to attackers.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Microsoft 365 |
| ID | 957cb240-f45d-4491-9ba5-93430a3c08be |
| Severity | Low |
| Status | Available |
| Kind | Scheduled |
| Tactics | Persistence, Collection |
| Techniques | T1098, T1114 |
| Required Connectors | Office365 |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
OfficeActivity |
Operation in "Add-MailboxFolderPermission,Add-MailboxPermission,New-InboxRule,New-ManagementRoleAssignment,Set-InboxRule,Set-Mailbox,Set-TransportRule"UserId has_any "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)" |
✓ | ✗ | ✓ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊