type: attack-pattern
spec_version: 2.1
id: attack-pattern--e74de37c-a829-446c-937d-56a44f0e9306
created: 2020-01-19T16:54:28.516Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1098/002
external_id: T1098.002
source_name: Bienstock, D. - Defending O365 - 2019
description: Bienstock, D.. (2019). BECS and Beyond: Investigating and Defending O365. Retrieved November 17, 2024.
url: https://www.slideshare.net/slideshow/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365/128744511
source_name: Crowdstrike Hiding in Plain Sight 2018
description: Crowdstrike. (2018, July 18). Hiding in Plain Sight: Using the Office 365 Activities API to Investigate Business Email Compromises. Retrieved January 19, 2020.
url: https://www.crowdstrike.com/blog/hiding-in-plain-sight-using-the-office-365-activities-api-to-investigate-business-email-compromises/
source_name: Google Ensuring Your Information is Safe
description: Google. (2011, June 1). Ensuring your information is safe online. Retrieved April 1, 2022.
url: https://googleblog.blogspot.com/2011/06/ensuring-your-information-is-safe.html
source_name: Gmail Delegation
description: Google. (n.d.). Turn Gmail delegation on or off. Retrieved April 1, 2022.
url: https://support.google.com/a/answer/7223765?hl=en
source_name: FireEye APT35 2018
description: Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024.
url: https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf
source_name: Mandiant Defend UNC2452 White Paper
description: Mandiant. (2021, January 19). Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452. Retrieved January 22, 2021.
url: https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452
source_name: Microsoft - Add-MailboxPermission
description: Microsoft. (n.d.). Add-Mailbox Permission. Retrieved September 13, 2019.
url: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:32.801Z
name: Additional Email Delegate Permissions
description: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. 

For example, the Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: Google Ensuring Your Information is Safe) 

Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.(Citation: Mandiant Defend UNC2452 White Paper)

This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
kill_chain_name: mitre-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Microsoft Detection and Response Team (DART)
Mike Burns, Mandiant
Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
Arad Inbar, Fidelis Security
Nilesh Dherange (Gurucul)
Naveen Vijayaraghavan
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Office Suite
x_mitre_version: 2.2