ATT&CK technique
View on MITRE ATT&CK →
T1098.002
Additional Email Delegate Permissions
PersistencePrivilege Escalation
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | M365 Exchange Mailbox High-Risk Permission Delegated | production | 2026-09-18 |
| elastic | New ActiveSyncAllowedDeviceID Added via PowerShell | production | 2026-09-18 |
| splunk | O365 Elevated Mailbox Permission Assigned | production | 2026-05-13 |
| splunk | O365 FullAccessAsApp Permission Assigned | production | 2026-05-13 |
| splunk | Azure AD FullAccessAsApp Permission Assigned | production | 2026-05-13 |
| splunk | O365 Mailbox Folder Read Permission Granted | production | 2026-05-13 |
| splunk | O365 Mailbox Folder Read Permission Assigned | production | 2026-05-13 |
| splunk | O365 ApplicationImpersonation Role Assigned | production | 2026-05-13 |