Exchange mailbox delegate permission granted from a command line

Siemphony@siemphonylowT1098.002unverified

Matches process creation where the command line carries one of the Exchange cmdlets that give another principal standing access to a mailbox — the mechanism AN1052 describes, and the one behind the Default and Anonymous folder grants used to keep reading a victim's mail after the initial compromise. The whole match is a single CommandLine gate on the cmdlet name, so it holds whichever shell or script host runs it; the analytic's PowerShellCmdletFilter knob is where that list is widened or narrowed, populated here with the mailbox, recipient, folder and Send-As delegation cmdlets. Two limits are structural rather than tunable: a cmdlet typed inside an interactive Exchange Management Shell or an implicitly remoted session is never an argument to a process, so only -Command style invocations that carry the cmdlet name in the argument string are visible at all — a powershell.exe -File run of the same script never shows the cmdlet, and -EncodedCommand hides it behind base64 — and the authoritative record of a delegation change is the Exchange admin audit log or the Microsoft 365 unified audit log, neither of which is a log source in this brief. The brief maps Security EventID 4688 onto the Sysmon-shaped process_creation category and this rule is written in that vocabulary, gating only on CommandLine, which both feeds carry; a 4688 feed needs both Audit Process Creation and the separate Include command line in process creation events policy enabled first, or CommandLine is never populated and the rule returns zero rows for the wrong reason. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0373, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "Add-MailboxPermission" or ProcessCommandLine contains "Add-RecipientPermission" or ProcessCommandLine contains "Add-MailboxFolderPermission" or ProcessCommandLine contains "Set-MailboxFolderPermission" or ProcessCommandLine contains "Add-ADPermission")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*Add-MailboxPermission*" OR CommandLine="*Add-RecipientPermission*" OR CommandLine="*Add-MailboxFolderPermission*" OR CommandLine="*Set-MailboxFolderPermission*" OR CommandLine="*Add-ADPermission*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*add-mailboxpermission*" OR TO_LOWER(process.command_line) LIKE "*add-recipientpermission*" OR TO_LOWER(process.command_line) LIKE "*add-mailboxfolderpermission*" OR TO_LOWER(process.command_line) LIKE "*set-mailboxfolderpermission*" OR TO_LOWER(process.command_line) LIKE "*add-adpermission*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Add-MailboxPermission|Add-RecipientPermission|Add-MailboxFolderPermission|Set-MailboxFolderPermission|Add-ADPermission)</field>    <description>Exchange mailbox delegate permission granted from a command line</description>    <mitre>      <id>T1098.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: account_manipulation
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: bf75c7b0-eefc-470c-9a23-b0c0da55cf45

ATT&CKT1098.002

T1098.002Additional Email Delegate Permissions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonaccount manipulation

account manipulationAI draft — unreviewed

01 · What this rule detects

Exchange delegation grants issued from a command line. After an initial compromise, an attacker who can run Exchange cmdlets grants a controlled account — or the Default and Anonymous principals, the trick in Mandiant's UNC2452 write-up — standing access to a victim's mailbox or its folders. Reading the mail then needs no further access to the victim's account. AN1052 describes exactly this: PowerShell execution modifying mailbox permissions via Exchange cmdlets.

02 · Telemetry you need

Windows process creation, category: process_creation, product: windows, taken from the brief. The brief's underlying source is Security EventID 4688, which the scaffold maps onto the Sysmon-shaped process_creation category; the rule is written in that Sysmon vocabulary and gates only on CommandLine, a field both feeds carry, so the mapping costs nothing here. A 4688 feed needs Audit Process Creation and the separate Include command line in process creation events policy; neither is on by default, and without the second CommandLine is blank and the rule returns zero rows for the wrong reason. Say the harder thing too: the authoritative record of a delegation change is the Exchange admin audit log or the Microsoft 365 unified audit log, and a cloud-only tenant will produce zero matches here because there is no host to log on. Zero means blind, not clean.

03 · How the logic works

One selection, one field. CommandLine|contains over five cmdlet names: Add-MailboxPermission, Add-RecipientPermission, Add-MailboxFolderPermission, Set-MailboxFolderPermission, Add-ADPermission. condition: selection. MITRE names the knob — PowerShellCmdletFilter — but the five values are the pipeline's own choice, covering mailbox, recipient, folder and Send-As delegation. There is deliberately no Image or parent gate. The cmdlet can arrive through powershell.exe, pwsh.exe, a cmd.exe wrapper or any script host, and a shell-agnostic gate catches all of them. The cost is precision: notepad.exe C:\admin\Add-MailboxPermission.ps1, a findstr across a script library, or a backup job whose arguments include such a path all match without any permission changing. Check Image on triage. Three blind spots are structural, not tunable. A cmdlet typed at an interactive Exchange Management Shell prompt, or run through implicit remoting, is never an argument to a process. powershell.exe -File grant.ps1 runs the cmdlet without its name ever reaching a command line. -EncodedCommand hides it in base64. What remains visible is plaintext -Command style invocation on-premises — a real slice, but a narrow one.

04 · Common false positives

Routine delegation dominates. Helpdesk and Exchange admins granting shared-mailbox, calendar or leave-cover access as a one-liner produce the largest share of matches in any organisation using shared mailboxes, and nothing in a process-creation event distinguishes that from the adversary use. Migration and archiving suites script Add-MailboxPermission to give a service account FullAccess per mailbox for a move; provisioning automation sets standard folder permissions on every new mailbox; backup and eDiscovery tools grant themselves Send-As via Add-ADPermission. The rule sits at level: low because its loudest false positive is also its most common match.

05 · Detection maturity

tier_1: Lowest tier until it has been run against real data. Nothing here has touched a log line: no true positive, no measured false-positive volume, no idea how many editor and grep matches you will get. Clean rendering in four backends proves syntax only. Hunt with it over a month of process telemetry, compare what it returns to what the Exchange admin audit log says actually changed, and that gap is your first honest measurement.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Pair it with the audit log rather than alerting on it alone. Apply MITRE's ExecutionParent knob to flag shells launched by non-admins, and scope SubjectUserName away from your known delegation operators. TimeWindow, MITRE's third knob, is the interesting one: a grant followed shortly by Send-As activity from the grantee is the pattern worth waking someone for, and that correlation lives in the SIEM, not in this rule. Raise the level only once the selection gains a real discriminator — a non-admin grantor, or a Default/Anonymous grantee.

Declared by the author

Exchange administrators and helpdesk staff granting shared-mailbox, calendar or leave-cover access as a scripted one-liner. Routine delegation is the largest source of matches in any organisation that uses shared mailboxes, and nothing in the process-creation event distinguishes it from the adversary use this rule is written for.
Mailbox migration, archiving and consolidation suites that script Add-MailboxPermission to give their own service account FullAccess to each mailbox for the duration of a move and remove it afterwards, firing once per mailbox in the batch.
User-provisioning automation run from a management server or scheduled task that sets standard folder permissions on every newly created mailbox.
Backup and eDiscovery tooling that grants itself Send-As or FullAccess through Add-ADPermission before a scheduled collection run.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1098.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/bf75c7b0-eefc-470c-9a23-b0c0da55cf45

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Exchange mailbox delegate permission granted from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it