Microsoft 365 mailbox folder shared broadly
A mailbox folder was granted read or write access for a BROAD principal — Everyone, Anonymous or Default — rather than a named person.
What it detects
A mailbox folder was granted read or write access for a BROAD principal — Everyone, Anonymous or Default — rather than a named person.
This is mailbox exfiltration by permission rather than by forwarding. Instead of a rule that copies mail out (which mail-flow monitoring catches), the attacker simply makes the victim's Inbox readable by every account in the tenant, then reads it from any compromised identity. Nothing leaves the tenant, no rule exists to find, and the audit record looks like ordinary folder sharing.
Matching requires both the broad grantee AND a meaningful right, because the same operation with FreeBusySimple on a Calendar is Exchange's own default and appears constantly.
MITRE ATT&CK mapping
False positives and triage
Broad calendar sharing is normal and is deliberately excluded — FreeBusySimple and None do not match. Some organisations do legitimately open a shared or resource mailbox to Default, so confirm whether the folder belongs to a person or to a shared resource. The signal is a named user's Inbox (or a Sent Items / Contacts folder) becoming readable tenant-wide, especially performed by the mailbox owner's own account shortly after a suspicious sign-in — an attacker acting AS the victim.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_mailbox_folder_shared_broadly.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mailbox_folder_shared_broadly
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1114.002, T1098.002]
description: |
A mailbox folder was granted read or write access for a BROAD principal —
`Everyone`, `Anonymous` or `Default` — rather than a named person.
This is mailbox exfiltration by permission rather than by forwarding. Instead of a
rule that copies mail out (which mail-flow monitoring catches), the attacker simply
makes the victim's Inbox readable by every account in the tenant, then reads it from
any compromised identity. Nothing leaves the tenant, no rule exists to find, and the
audit record looks like ordinary folder sharing.
Matching requires both the broad grantee AND a meaningful right, because the same
operation with `FreeBusySimple` on a Calendar is Exchange's own default and appears
constantly.
match:
provider: Office365
event_action_contains_any:
- ModifyFolderPermissions
- AddFolderPermissions
raw_message_regex: "folder_member=(Everyone|Anonymous|Default)\\b.*folder_rights=(ReadAny|Reviewer|Editor|Owner|Author|Contributor|PublishingEditor|PublishingAuthor|NonEditingAuthor)"
correlation_keys: [user_name]
false_positive_guidance: |
Broad calendar sharing is normal and is deliberately excluded — `FreeBusySimple` and
`None` do not match. Some organisations do legitimately open a shared or resource
mailbox to `Default`, so confirm whether the folder belongs to a person or to a
shared resource. The signal is a named user's Inbox (or a Sent Items / Contacts
folder) becoming readable tenant-wide, especially performed by the mailbox owner's
own account shortly after a suspicious sign-in — an attacker acting AS the victim.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.