[Rule Tuning] O365 Exchange Suspicious Mailbox Right Delegation

[BCall-BT]

## Link to rule

Description

Typo in the filter used to exclude "NT AUTHORITY\SYSTEM" from the alerts due to it being case-sensitive.

Current query has "not user.id : "NT AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)". However, the log data coming in from Microsoft has a capital "H" in servicehost. The filter should be not user.id : "NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)"

Example Data

image

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.