AN2033: Analytic 2033
Detects suspicious inbound communications or collaboration requests followed by rapid sensitive user actions such as file sharing changes, macro enablement, OAuth consent, credential submission, or financial workflow approvals that deviate from historical relationships or normal approval patterns.
Analyst context for executives and security teams
Analytic 2033 is about spotting a risky sequence in Office Suite environments: an unusual inbound communication or collaboration request is quickly followed by sensitive user behavior, such as changing file sharing, enabling macros, granting OAuth consent, submitting credentials, or approving financial workflows. For leaders, the value is not just detecting a single suspicious message; it is validating whether the organization can connect collaboration activity to high-risk follow-on actions before identity, data access, or business approval processes are abused.
Executive priority
Prioritize this analytic where Office Suite collaboration, file sharing, OAuth consent, and approval workflows are material to business operations. It supports executive questions such as: can security teams see when an external interaction leads to sensitive user action, can they distinguish normal business relationships from abnormal ones, and can they produce evidence for investigation, audit, or incident response decisions. The highest business value is in reducing blind spots between messaging, collaboration, identity consent, document handling, and financial approval telemetry.
Technical view
SOC and detection teams should validate whether Office Suite logs can correlate inbound communications or collaboration requests with rapid sensitive user actions by the same user or within the same workflow. The analytic depends on baselining historical relationships and normal approval patterns, so teams should test whether they have enough identity, collaboration, file-sharing, macro-related, OAuth consent, credential submission, and approval workflow evidence to establish deviation. Because no official detection logic is provided, implementation should be treated as a behavior-correlation use case rather than a ready-made rule.
Likely telemetry
- Office Suite inbound communication and collaboration request events
- File sharing and permission change logs
- Macro enablement or document security-related events where available
- OAuth application consent and permission grant events
- Credential submission or authentication-related evidence available to defenders
Detection direction
- Correlate suspicious inbound communications or collaboration requests with sensitive user actions occurring shortly afterward.
- Baseline historical relationships between users, external senders, collaborators, applications, and approval workflows before treating a deviation as high confidence.
- Tune for business context: new vendor relationships, legitimate urgent approvals, and first-time collaboration can create false positives.
- Validate coverage across separate systems; Office Suite, identity consent, file sharing, and financial workflow logs may not be retained or normalized in the same place.
- Prioritize alerts where multiple sensitive actions occur after the inbound request, such as sharing changes plus OAuth consent or financial approval.
Mitigation priorities
- Ensure logging is enabled and retained for Office Suite collaboration, file sharing, OAuth consent, and approval workflows.
- Require review or control gates for high-risk user actions such as broad sharing changes, sensitive OAuth consent, macro enablement, and financial approvals.
- Maintain baselines of normal communication relationships and approval patterns for users in sensitive roles.
- Integrate identity, collaboration, and business workflow logs into SOC workflows so incident responders can reconstruct the sequence quickly.
- Use security awareness and process controls for users who can approve financial workflows or grant sensitive access, without relying on awareness as the only control.
Analyst notes and limits
This is a detection analytic object, not a technique description. Its practical value is in cross-domain correlation: the suspicious condition is the sequence and deviation from normal relationships, not any single event by itself. Glexia would treat this as a validation target for managed detection, identity monitoring, cloud collaboration security, and incident response readiness in Office Suite environments.
The supplied ATT&CK fields do not include official detection logic, tactics, mitigations, data sources, or relationships. The object only specifies Office Suite as the platform and provides a high-level behavioral description. Local environment telemetry, retention, workflow design, and baseline quality are required to determine feasibility, tuning, and confidence.
Analytic 2033
Detects suspicious inbound communications or collaboration requests followed by rapid sensitive user actions such as file sharing changes, macro enablement, OAuth consent, credential submission, or financial workflow approvals that deviate from historical relationships or normal approval patterns.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 1c11711dedf0… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN2033Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.