T1098.002sub-technique of T1098 Account Manipulation
Additional Email Delegate Permissions
Windows · Office Suite1 piece on this siteT1098.002 on attack.mitre.org
Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the `Add-MailboxPermission` PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox. In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
how MITRE says to see it
Detection Strategy for Addition of Email Delegate Permissions
- Detection of anomalous or unauthorized mailbox delegation activity (e.g., Add-MailboxPermission, Default/Anonymous mailbox permissions, Gmail delegation setup).
- Execution of PowerShell commands that modify mailbox permissions using Exchange cmdlets (e.g., Add-MailboxPermission), often tied to BEC or post-compromise persistence.
what reduces it
- M1026 Privileged Account Management. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
- M1032 Multi-factor Authentication. Use multi-factor authentication for user and privileged accounts.
- M1042 Disable or Remove Feature or Program. If email delegation is not required, disable it. In Google Workspace this can be accomplished through the Google Admin console.