MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.[1]
3
TechniquesBottom 12%
3
TacticsBottom 21%
1
Threat groupunranked
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MailSniper can be used for searching through email in Exchange and Office 365 environments.4
Collection11 detection rules
Standing S0413
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques3Bottom 12%
12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.
Tactics3Bottom 21%
21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.
Threat group161% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique11medBottom 19%
19th percentile · 81% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique1med
MailSniper detections S0413
59 distinct rules cover the 3 techniques recorded for this tool. 51 Splunk · 8 Sigma.
2 covered by at least one rule1 with no coverage59 distinct rules in total
Showing 1-50 of 59 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. (...)
The following analytic identifies a single source IP failing to authenticate with multiple valid users, potentially indicating a Password Spraying attack against an Azure Active Directory tenant. (...)
The following analytic detects a single source IP address failing to authenticate into more than 20 unique Google Workspace user accounts within a 5-minute window. (...)
The following analytic identifies a single source IP failing to authenticate into Google Workspace with multiple valid users, potentially indicating a Password Spraying attack. (...)
The following analytic identifies when a user with sufficient access to O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. (...)
The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a mailbox within a limited timeframe. (...)
The following analytic identifies instances where the Mail.Read Graph API permissions are granted to an application registration within an Office 365 tenant. (...)
The following analytic identifies a spike in failed authentication attempts within an Office 365 environment, indicative of a potential distributed password spraying attack. (...)
The following analytic detects when a high number of Office 365 Exchange mailboxes are accessed via API (Microsoft Graph API or Exchange Web Services) within a short timeframe. (...)
The following analytic identifies instances where more than 10 unique user accounts fail to authenticate from a single IP address within a 5-minute window. (...)
The following analytic detects when emails are accessed in Office 365 Exchange via Exchange Web Services (EWS) using OAuth-authenticated applications. (...)
The following analytic detects when emails are accessed in Office 365 Exchange via the Microsoft Graph API using the client ID '00000003-0000-0000-c000-000000000000'. (...)
The following analytic identifies instances where more than 10 unique user accounts have failed to authenticate from a single IP address within a 5-minute window in an Okta tenant. (...)
The following analytic detects a single source endpoint failing to authenticate with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. (...)