Home/ MITRE Matrix/ Persistence/ T1098.002

T1098.002Additional Email Delegate Permissions

T1098.002 — Additional Email Delegate Permissions is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 9 detection use cases covering it and 1 threat-intel article citing it.

PersistencePrivilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

1Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1098 · Account Manipulation

Use cases covering this technique (9)

M365 mailbox delegation granted Internal install · alerting DD Azure AD FullAccessAsApp Permission Assigned ESCU actions · alerting P O365 ApplicationImpersonation Role Assigned ESCU actions · alerting P O365 Elevated Mailbox Permission Assigned ESCU actions · alerting P O365 FullAccessAsApp Permission Assigned ESCU actions · alerting P O365 Mailbox Folder Read Permission Assigned ESCU actions · alerting P O365 Mailbox Folder Read Permission Granted ESCU actions · alerting P O365 Suspicious Rights Delegation ESCU actions · alerting P [LLM] OWAReaper server-side persistence: Owner rights granted to 'Default' user on mailbox folders Bespoke install · alerting DSΣP

Articles citing this technique (1)

high Russian hackers exploit Exchange OWA zero-day for long-term mailbox access art-02