name: O365 Suspicious Rights Delegation
id: b25d2973-303e-47c8-bacd-52b61604c6a7
version: 1
date: '2020-12-15'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search detects the assignment of rights to accesss content from
  another mailbox. This is usually only assigned to a service account.
search: '`o365_management_activity` Operation=Add-MailboxPermission | spath input=Parameters
  | rename User AS src_user, Identity AS dest_user | search AccessRights=FullAccess
  OR AccessRights=SendAs OR AccessRights=SendOnBehalf | stats count earliest(_time)
  as firstTime latest(_time) as lastTime by user src_user dest_user Operation AccessRights
  |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_rights_delegation_filter`'
how_to_implement: ''
known_false_positives: Service Accounts
references: []
tags:
  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
  cis20:
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/suspicious_rights_delegation.json
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1114.002
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Operation
  - Parameters
  security_domain: threat
