AN1051: Analytic 1051
Detection of anomalous or unauthorized mailbox delegation activity (e.g., Add-MailboxPermission, Default/Anonymous mailbox permissions, Gmail delegation setup).
Analyst context for executives and security teams
This analytic is about spotting unusual or unauthorized mailbox delegation in office suites, such as mailbox permission changes, Default/Anonymous mailbox access, or Gmail delegation setup. For leaders, the practical risk is that delegated mailbox access can let someone read, send, or monitor business communications without using the mailbox owner’s credentials directly. That makes it important for executive communications, legal or finance workflows, incident response scoping, and audit evidence around who can access sensitive mail.
Executive priority
Prioritize this as an identity and collaboration-platform control validation item. Security leaders should ask whether mailbox delegation is governed, logged, reviewed, and tied to approved business processes. Because the ATT&CK object provides no tactic mapping or detection logic, the immediate value is not a ready-made alert but a prompt to verify that SOC, IAM, and cloud/email administration teams can prove who granted mailbox access, when it changed, whether it was authorized, and whether risky Default/Anonymous permissions are present.
Technical view
SOC and detection teams should validate telemetry for Office Suite mailbox permission changes and delegation configuration events. The analytic scope explicitly includes anomalous or unauthorized mailbox delegation activity, including Add-MailboxPermission-style changes, Default/Anonymous mailbox permissions, and Gmail delegation setup. Detection engineering should focus on baselining normal administrative and helpdesk delegation activity, identifying delegation granted to unusual users or groups, and correlating permission changes with account, admin, and mailbox context. Incident responders should treat confirmed unauthorized delegation as a persistence and data-access scoping concern, requiring review of affected mailboxes and related administrative activity.
Likely telemetry
- Office suite audit logs for mailbox permission and delegation changes
- Email administration logs showing who granted, modified, or removed mailbox access
- Mailbox permission inventories, including Default and Anonymous permissions where available
- Gmail or equivalent office-suite delegation configuration records
- Identity and admin activity logs for the account performing the delegation change
Detection direction
- Validate that mailbox delegation changes are actually logged and retained for the relevant office suite environment.
- Build or tune detections for new, unusual, or high-risk delegation grants, especially access granted outside expected admin workflows.
- Review Default and Anonymous mailbox permissions for exposure that may not look like a named-user delegation event.
- Baseline legitimate helpdesk, executive assistant, shared mailbox, and compliance workflows to reduce false positives.
- Correlate delegation changes with the actor account, target mailbox, recipient of access, timing, and any available approval record.
Mitigation priorities
- Establish a formal approval and review process for mailbox delegation and shared mailbox access.
- Limit who can grant mailbox permissions or configure delegation in office-suite administration roles.
- Regularly review mailbox permission inventories, with specific attention to Default and Anonymous permissions.
- Require retention and monitoring of office-suite audit logs needed to investigate delegation changes.
- Use periodic access recertification for sensitive mailboxes, executive accounts, legal, finance, and other high-risk communications.
Analyst notes and limits
This ATT&CK object is a detection analytic, not a technique, and has no supplied relationship context. Its value is in directing defenders to validate governance and monitoring around mailbox delegation in Office Suite environments. The supplied description names examples across Microsoft-style mailbox permission changes and Gmail delegation setup, so implementations should be adapted to the organization’s actual office-suite platforms and logging model.
The official detection field is not provided, tactics are not specified, and no relationships are supplied. This take therefore avoids asserting attacker intent, active exploitation, attribution, impact, or guaranteed detection coverage. Local telemetry, administrative workflows, and mailbox permission models are required to operationalize the analytic.
Analytic 1051
Detection of anomalous or unauthorized mailbox delegation activity (e.g., Add-MailboxPermission, Default/Anonymous mailbox permissions, Gmail delegation setup).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 81974c544162… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1051Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.