Microsoft 365 legacy protocol enabled
A legacy mail protocol (IMAP or POP) was ENABLED on a mailbox (Set-CASMailbox ImapEnabled/PopEnabled = true).
What it detects
A legacy mail protocol (IMAP or POP) was ENABLED on a mailbox (Set-CASMailbox ImapEnabled/PopEnabled = true). Turning a legacy protocol back on re-opens a basic-auth channel that bypasses MFA — a deliberate weakening of identity controls to set up durable mail exfiltration after a compromise.
MITRE ATT&CK mapping
False positives and triage
Some environments legitimately use IMAP/POP for specific mailboxes. The signal is a protocol enabled outside a change window, by an unexpected actor, or on an account tied to other suspicious activity. Confirm the change was intended.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_legacy_protocol_enabled.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_legacy_protocol_enabled
version: 1.1.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
# T1114.002 as well as the control-weakening pair: re-opening IMAP/POP is
# not an end in itself, it is how mail is then collected remotely, and a
# labelled corpus tags this activity as email collection.
mitre_techniques: [T1556, T1562.001, T1114.002]
description: |
A legacy mail protocol (IMAP or POP) was ENABLED on a mailbox
(Set-CASMailbox ImapEnabled/PopEnabled = true). Turning a legacy protocol back
on re-opens a basic-auth channel that bypasses MFA — a deliberate weakening of
identity controls to set up durable mail exfiltration after a compromise.
match:
provider: Office365
event_action_any:
- "Set-CASMailbox"
raw_message_contains_any:
- "ImapEnabled=True"
- "PopEnabled=True"
correlation_keys: [user_name]
false_positive_guidance: |
Some environments legitimately use IMAP/POP for specific mailboxes. The signal is
a protocol enabled outside a change window, by an unexpected actor, or on an
account tied to other suspicious activity. Confirm the change was intended.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.