MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1098.002` Additional Email Delegate Permissions

Sub-technique of T1098 Account Manipulation

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation:…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT28

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.