Detecting and Mitigating Email Delegate Permission Abuse (T1098.002)

Mailbox access is valuable and quiet. Additional Email Delegate Permissions (T1098.002) is a sub-technique of Account Manipulation that gives an attacker a back door into someone's mail. MITRE lists it under persistence and privilege escalation, for Windows and Office Suite environments.

How attackers use it

MITRE says adversaries may grant additional permission levels to keep persistent access to an adversary controlled email account. The page names these routes:

• The Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and Office 365, adds permissions to a mailbox.
• In Google Workspace, delegation can be enabled in the Google Admin console, and users can delegate accounts through Gmail settings.
• Folder permissions. In Office 365, adversaries may assign the Default or Anonymous user permissions or roles to the root of the information store, the Inbox or other folders. With that, any other account in the tenant can maintain access to the target user's mail folders.

MITRE says this appears in persistent threat incidents and in business email compromise (BEC) incidents. Compromised business accounts are often used to send messages to other accounts in the target's network while creating inbox rules, so the messages evade spam and phishing detection.

How to detect it

MITRE's strategy (DET0373) lists two analytics:

• Anomalous or unauthorized mailbox delegation, such as Add-MailboxPermission, Default or Anonymous mailbox permissions, or Gmail delegation setup.
• PowerShell commands using Exchange cmdlets that change mailbox permissions, often tied to BEC or persistence after compromise.

Enable mailbox and admin audit logging for Exchange Online or on-premises Exchange, and Google Workspace audit logs for delegation changes. Alert on any permission change that was not requested through a ticket, and report on mailboxes where Default or Anonymous hold access beyond the standard.

How to reduce the risk

MITRE lists three mitigations:

1. If email delegation is not required, disable it. In Google Workspace this can be done in the Google Admin console (Disable or Remove Feature or Program).
2. Use multi-factor authentication for user and privileged accounts.
3. Do not use domain administrator accounts for day to day operations that expose them on unprivileged systems (Privileged Account Management).

Check your own environment

• Which mailboxes have delegates, and does each have an owner who knows?
• Do any folders grant permissions to Default or Anonymous?
• Is admin audit logging on, and are mailbox permission changes alerted?

For Exchange Online or on-premises Exchange, an administrator can run a read-only listing in PowerShell:

Get-MailboxPermission -Identity user@example.com

Replace the address with a mailbox from your own tenant.

Quick check

Sources

• MITRE ATT&CK, T1098.002 Additional Email Delegate Permissions: https://attack.mitre.org/techniques/T1098/002/