T1098.002 — Additional Email Delegate Permissions

Tactics: Persistence, Privilege Escalation · Platforms: Windows, Office Suite

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox. In Google…

Sub-technique of Account Manipulation (T1098).

Sigma detection rules (2)

T1098.002 Account Manipulation: Additional Email Delegate Permissions

title: "T1098.002 Account Manipulation: Additional Email Delegate Permissions"
id: 7db7dd12-d520-4bff-8619-600cca6f7ec6
description: 'Detects PowerShell/Exchange Management Shell cmdlets that grant mailbox delegate permissions (Add-MailboxPermission, Add-RecipientPermission, Add-ADPermission, Add-MailboxFolderPermission), which adversaries use to maintain persistent access to a compromised mailbox. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: PowerShellCmdletFilter, ExecutionParent, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1098/002
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.002

logsource:
  category: process_creation
  product: windows
  service: security

detection:
  selection:
    EventID: '4688'
    CommandLine|contains:
      - 'Add-MailboxPermission'
      - 'Add-RecipientPermission'
      - 'Add-ADPermission'
      - 'Add-MailboxFolderPermission'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate Exchange/M365 administration delegating mailbox access for coverage, migrations, or shared-mailbox setup.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1098.002 Account Manipulation: Additional Email Delegate Permissions

title: "T1098.002 Account Manipulation: Additional Email Delegate Permissions"
id: 5d12a6fd-6a44-4612-a7b0-bdee99456322
description: 'Detection Strategy for Addition of Email Delegate Permissions. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: DelegatePermissionLevel, FolderTargetScope, DelegatorToDelegatePairing, MailflowAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1098/002
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.002

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Add-MailboxPermission'
      - 'Add-RecipientPermission'
  fullaccess:
    Parameters|contains: 'FullAccess'

  condition: selection and fullaccess

falsepositives:
  - Legitimate delegation of full access for shared team mailboxes or executive assistants.

level: high

Related sub-techniques

Explore