Email access via active sync

Hunt Hypothesis

Attackers may be attempting to compromise email accounts by adding malicious devices as allowed ActiveSync IDs, which could enable remote access and data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential compromise of email infrastructure and prevent further lateral movement.

KQL Query

let timeframe = 1d;
let cmdList = dynamic(["Set-CASMailbox","ActiveSyncAllowedDeviceIDs","add"]);
(union isfuzzy=true
(
SecurityEvent
| where TimeGenerated >= ago(timeframe)
| where EventID == 4688
| where CommandLine has_all (cmdList)
| project Type, TimeGenerated, Computer, Account, SubjectDomainName, SubjectUserName, Process, ParentProcessName, CommandLine
| extend timestamp = TimeGenerated, AccountEntity = Account, HostEntity = Computer
),
( WindowsEvent
| where TimeGenerated >= ago(timeframe)
| where EventID == 4688
| where EventData has_all (cmdList)
| extend CommandLine = tostring(EventData.CommandLine) 
| where CommandLine has_all (cmdList)
| extend Account =  strcat(tostring(EventData.SubjectDomainName),"\\", tostring(EventData.SubjectUserName))
| extend SubjectUserName = tostring(EventData.SubjectUserName)
| extend SubjectDomainName = tostring(EventData.SubjectDomainName)
| extend NewProcessName = tostring(EventData.NewProcessName)
| extend Process=tostring(split(NewProcessName, '\\')[-1])
| extend ParentProcessName = tostring(EventData.ParentProcessName)
| project Type, TimeGenerated, Computer, Account, SubjectDomainName, SubjectUserName, Process, ParentProcessName, CommandLine
| extend timestamp = TimeGenerated, AccountEntity = Account, HostEntity = Computer
),
(
DeviceProcessEvents
| where TimeGenerated >= ago(timeframe)
| where InitiatingProcessCommandLine has_all (cmdList)
| project Type, TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessParentFileName,  InitiatingProcessCommandLine
| extend timestamp = TimeGenerated, AccountDomain = InitiatingProcessAccountDomain, AccountName = InitiatingProcessAccountName, HostEntity = DeviceName
),
(
Event
| where TimeGenerated > ago(timeframe)
| where Source == "Microsoft-Windows-Sysmon"
| where EventID == 1
| extend EventData = parse_xml(EventData).DataItem.EventData.Data
| mv-expand bagexpansion=array EventData
| evaluate bag_unpack(EventData)
| extend Key=tostring(['@Name']), Value=['#text']
| evaluate pivot(Key, any(Value), TimeGenerated, Source, EventLog, Computer, EventLevel, EventLevelName, EventID, UserName, RenderedDescription, MG, ManagementGroupName, Type, _ResourceId)
| where TimeGenerated >= ago(timeframe)
| where CommandLine has_all (cmdList)
| extend Type = strcat(Type, ": ", Source)
| project Type, TimeGenerated, Computer, User, Process, ParentImage, CommandLine
| extend timestamp = TimeGenerated, AccountEntity = User, HostEntity = Computer
)
)
| extend HostName = tostring(split(HostEntity, ".")[0]), DomainIndex = toint(indexof(HostEntity, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(HostEntity, DomainIndex + 1), HostEntity)
| extend AccountName = tostring(split(AccountEntity, @'\')[1]), AccountDomain = tostring(split(AccountEntity, @'\')[0])

Analytic Rule Definition

id: 2f561e20-d97b-4b13-b02d-18b34af6e87c
name: Email access via active sync
description: |
   This query detects attempts to add attacker devices as allowed IDs for active sync using the Set-CASMailbox command.
   This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
   - Note that this query can be changed to use the KQL "has_all" operator, which hasn't yet been documented officially, but will be soon.
     In short, "has_all" will only match when the referenced field has all strings in the list.
   - Refer to Set-CASMailbox syntax: https://docs.microsoft.com/powershell/module/exchange/set-casmailbox?view=exchange-ps  
severity: Medium
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
  - connectorId: WindowsSecurityEvents
    dataTypes: 
      - SecurityEvents 
  - connectorId: WindowsForwardedEvents
    dataTypes: 
      - WindowsEvent 
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1068
  - T1078
tags:
  - Solorigate
  - NOBELIUM
query: |
  let timeframe = 1d;
  let cmdList = dynamic(["Set-CASMailbox","ActiveSyncAllowedDeviceIDs","add"]);
  (union isfuzzy=true
  (
  SecurityEvent
  | where TimeGenerated >= ago(timeframe)
  | where EventID == 4688
  | where CommandLine has_all (cmdList)
  | project Type, TimeGenerated, Computer, Account, SubjectDomainName, SubjectUserName, Process, ParentProcessName, CommandLine
  | extend timestamp = TimeGenerated, AccountEntity = Account, HostEntity = Computer
  ),
  ( WindowsEvent
  | where TimeGenerated >= ago(timeframe)
  | where EventID == 4688
  | where EventData has_all (cmdList)
  | extend CommandLine = tostring(EventData.CommandLine) 
  | where CommandLine has_all (cmdList)
  | extend Account =  strcat(tostring(EventData.SubjectDomainName),"\\", tostring(EventData.SubjectUserName))
  | extend SubjectUserName = tostring(EventData.SubjectUserName)
  | extend SubjectDomainName = tostring(EventData.SubjectDomainName)
  | extend NewProcessName = tostring(EventData.NewProcessName)
  | extend Process=tostring(split(NewProcessName, '\\')[-1])
  | extend ParentProcessName = tostring(EventData.ParentProcessName)
  | project Type, TimeGenerated, Computer, Account, SubjectDomainName, SubjectUserName, Process, ParentProcessName, CommandLine
  | extend timestamp = TimeGenerated, AccountEntity = Account, HostEntity = Computer
  ),
  (
  DeviceProcessEvents
  | where TimeGenerated >= ago(timeframe)
  | where InitiatingProcessCommandLine has_all (cmdList)
  | project Type, TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessParentFileName,  InitiatingProcessCommandLine
  | extend timestamp = TimeGenerated, AccountDomain = Initi

Required Data Sources

MITRE ATT&CK Context

• Tactic: PrivilegeEscalation
• Technique: T1068 — T1068
• Technique: T1078 — T1078

References

• Source Query

False Positive Guidance

• Scenario: Admin configuring email access for a new remote employee
  Description: An IT administrator is setting up Active Sync access for a new remote employee using the Set-CASMailbox command.
  Filter/Exclusion: Exclude entries where the UserPrincipalName matches known admin accounts or is associated with a new user onboarding process.

• Scenario: Scheduled job for mailbox backups using PowerShell
  Description: A scheduled PowerShell script is running to configure Active Sync settings for mailbox backups, which may involve using Set-CASMailbox.
  Filter/Exclusion: Exclude events where the Command field contains “backup” or “restore” and the UserPrincipalName is associated with a backup service account.

• Scenario: Email client configuration for a legitimate device
  Description: A user is configuring their email client (e.g., Microsoft Outlook) to sync with their Exchange mailbox, which may trigger the Set-CASMailbox command.
  Filter/Exclusion: Exclude events where the UserPrincipalName is associated with a user who has recently changed their email client settings or is part of a known email client configuration task.

• Scenario: Exchange Online migration using PowerShell
  Description: During an Exchange Online migration, a PowerShell script is used to adjust Active Sync settings for migrated mailboxes.
  Filter/Exclusion: Exclude events where the Command field includes “Move-Mailbox” or “New-MoveRequest” and the UserPrincipalName is associated with a migration service account.

• Scenario: Compliance audit task adjusting mailbox settings
  Description: A compliance auditor is running a script to adjust Active Sync settings for mailboxes as part of a regulatory audit.
  Filter/Exclusion: Exclude events where the UserPrincipalName is associated with a compliance or audit service account, or where the `Command