Application Granted EWS Permissions

This query finds AD applications with EWS permissions to read user mailboxes. Threat actors could misuse these for persistent mailbox access. Ensure these permissions are legitimately granted and necessary.

Detection logic

Detection requirements

Platform: IaaS Identity Provider Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: azureactivedirectory azureactivedirectoryidentityprotection
Log source service: auditlogs securityalert_ipc

Detection rules

Application Granted EWS Permissions

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules