T1098.002: Additional Email Delegate Permissions
Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
For example, the Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.[1][2][3] In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.[4][5]
Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.[6]
This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add Additional Cloud Roles to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: Internal Spearphishing), so the messages evade spam/phishing detection mechanisms.[7]
Analyst context for executives and security teams
Additional Email Delegate Permissions is a persistence and privilege-escalation behavior where an adversary changes mailbox permissions so another account can keep access to a user’s email. For leaders, the business risk is that email can remain compromised even after a password reset if delegate, folder, Default, or Anonymous permissions are not reviewed and removed.
Executive priority
Prioritize this where email is used for executive communications, finance approvals, legal matters, regulated data, or incident response coordination. The key decision is whether the organization can prove who can access sensitive mailboxes, when permissions changed, and whether privileged email administration is governed by least privilege and MFA. This technique is also material to BEC investigations because mailbox access and internal messaging can support follow-on activity such as internal spearphishing.
Technical view
SOC, detection engineering, and IR teams should validate visibility into mailbox permission changes across Exchange/Office 365-style administration and user delegation paths. ATT&CK does not provide an official detection section for this object, but the supplied relationship identifies DET0373, Detection Strategy for Addition of Email Delegate Permissions, as detecting it. Investigations should focus on newly added mailbox permissions, delegated Gmail-style access where applicable to the environment, mailbox folder permissions, and risky Default or Anonymous permissions on root, Inbox, or other folders. Treat this as account manipulation: a password reset alone may not remove the adversary’s access path.
Likely telemetry
- Mailbox permission change logs, including Add-MailboxPermission-style administrative activity
- Cloud email audit logs and Office 365 activity/API records where available
- Mailbox folder permission records for root, Inbox, and other sensitive folders
- Delegation settings from email administration consoles and user mailbox settings
- Privileged administrator activity logs tied to mailbox and role changes
Detection direction
- Baseline normal mailbox delegation and alert on new or unusual delegate grants, especially for executives, finance, legal, administrators, and incident response mailboxes.
- Review Default and Anonymous permissions on mailbox folders; changes to these principals can create tenant-wide or broadly accessible persistence paths.
- Correlate permission changes with recent account compromise indicators, MFA events, password resets, and internal spearphishing-like email activity.
- Tune for legitimate helpdesk, executive assistant, shared mailbox, and compliance workflows to reduce false positives while preserving auditability.
- Validate whether DET0373 or equivalent local analytics cover both administrative permission changes and user-driven delegation paths.
Mitigation priorities
- Apply privileged account management: restrict who can grant mailbox permissions, enforce least privilege/RBAC, and maintain accountability through logging and auditing.
- Require MFA for accounts that administer or can materially change mailbox access, consistent with the related MFA mitigation.
- Disable or remove unnecessary delegation features or access paths where business processes do not require them.
- Periodically recertify mailbox delegates, shared mailbox access, folder permissions, and high-risk Default/Anonymous settings.
- Include mailbox permission evidence in compliance readiness and post-incident validation, especially for sensitive or regulated mailboxes.
Analyst notes and limits
This sub-technique sits under Account Manipulation and is mapped to persistence and privilege escalation. Supplied relationships show use by SolarWinds Compromise, HomeLand Justice, APT28, APT29, and Magic Hound, which supports treating the behavior as relevant to both targeted intrusion and BEC-style investigations without implying current activity in any specific environment.
The ATT&CK object does not include official detection text, and the related DET0373 strategy details were not supplied. Local email platform configuration, audit log retention, administrative model, and delegation business processes are required to determine actual detection coverage and remediation priority.
Additional Email Delegate Permissions
Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
For example, the Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.[1][2][3] In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.[4][5]
Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.[6]
This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add Additional Cloud Roles to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: Internal Spearphishing), so the messages evade spam/phishing detection mechanisms.[7]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1098 | Account Manipulation | This object subtechnique of Account Manipulation. |
Groups, software, and campaigns
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
G0016: APT29
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
C0038: HomeLand Justice
HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for HomeLand Justice was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was claimed by the "HomeLand Justice" front, which framed the campaign as retaliation against the Mujahedeen-e Khalq (MEK), an Iranian opposition group with a presence in Albania. Multiple Iran-nexus groups are assessed to have participated in the campaign, including HEXANE who probed victim infrastructure.[1][2][3] A second wave of attacks was launched in September 2022 using similar tactics following public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.[3]
C0024: SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.2 | Current bundle | a956f5087394… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Microsoft - Add-MailboxPermission
Microsoft. (n.d.). Add-Mailbox Permission. Retrieved September 13, 2019.
Open source URL -
[2]
FireEye APT35 2018
Mandiant. (2018). Mandiant M-Trends 2018. Retrieved November 17, 2024.
Open source URL -
[3]
Crowdstrike Hiding in Plain Sight 2018
Crowdstrike. (2018, July 18). Hiding in Plain Sight: Using the Office 365 Activities API to Investigate Business Email Compromises. Retrieved January 19, 2020.
Open source URL -
[4]
Gmail Delegation
Google. (n.d.). Turn Gmail delegation on or off. Retrieved April 1, 2022.
Open source URL -
[5]
Google Ensuring Your Information is Safe
Google. (2011, June 1). Ensuring your information is safe online. Retrieved April 1, 2022.
Open source URL -
[6]
Mandiant Defend UNC2452 White Paper
Mandiant. (2021, January 19). Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452. Retrieved January 22, 2021.
Open source URL -
[7]
Bienstock, D. - Defending O365 - 2019
Bienstock, D.. (2019). BECS and Beyond: Investigating and Defending O365. Retrieved November 17, 2024.
Open source URL -
[8]
mitre-attack T1098.002Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.