AN1051
Analytic 1051
Office Suite
Detection of anomalous or unauthorized mailbox delegation activity (e.g., Add-MailboxPermission, Default/Anonymous mailbox permissions, Gmail delegation setup).
m365:unified
Add-MailboxPermission, UpdateFolderPermissions
[DelegatePermissionLevel]
Threshold for unexpected delegate roles such as FullAccess or SendAs.
[FolderTargetScope]
Mailbox folder targeted by delegation (Inbox, Root, Calendar, etc.).
[DelegatorToDelegatePairing]
Pairings of delegate and delegator users that are expected.
[MailflowAnomalyThreshold]
Spike in outbound mail after delegate addition, used to catch phishing or mass exfil.
AN1052
Analytic 1052
Windows
Execution of PowerShell commands that modify mailbox permissions using Exchange cmdlets (e.g., Add-MailboxPermission), often tied to BEC or post-compromise persistence.
WinEventLog:Security
EventCode=4688
m365:unified
PowerShell: Add-MailboxPermission
[PowerShellCmdletFilter]
Exchange cmdlets to include or exclude based on scope (e.g., Add-MailboxPermission, Set-MailboxFolderPermission).
[ExecutionParent]
Flag suspicious script or interactive shell launch by non-admins.
[TimeWindow]
Window in which Add-MailboxPermission is followed by anomalous usage (e.g., SendAs events).