Sub-technique of T1098 Account Manipulation.View on attack.mitre.org
Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
For example, the Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox. In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.
Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.
This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add Additional Cloud Roles to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: Internal Spearphishing), so the messages evade spam/phishing detection mechanisms.
Rules on DetectionCode tagged with T1098.002.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Azure AD FullAccessAsApp Permission Assigned | TTP | NULL | Azure Active Directory Update application |
| O365 ApplicationImpersonation Role Assigned | TTP | NULL | O365 |
| O365 Elevated Mailbox Permission Assigned | TTP | NULL | O365 Add-MailboxPermission |
| O365 FullAccessAsApp Permission Assigned | TTP | NULL | O365 Update application. |
| O365 Mailbox Folder Read Permission Assigned | TTP | NULL | O365 ModifyFolderPermissions |
| O365 Mailbox Folder Read Permission Granted | TTP | NULL | O365 ModifyFolderPermissions |
| O365 Suspicious Rights Delegation | TTP | NULL |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT28 | APT28 has used a Powershell cmdlet to grant the |
| GroupAPT29 | APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails. |
| GroupMagic Hound | Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations. |
| Used by | Procedure example |
|---|---|
| CampaignHomeLand Justice | During HomeLand Justice, threat actors added the `ApplicationImpersonation` management role to accounts under their control to impersonate users and take ownership of targeted mailboxes. |
| CampaignSolarWinds Compromise | During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
