What is a one sentence summary of your feature request?
Adjust P-AdminEmailOn
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
Currently the check for the P-AdminEmailOn rule looks at the email attribute of admin accounts.
However, in our environments, we use the email attribute to document the email address of the low level user account of the administrator. This address is then used to send mails to the owner of the account about password expiration etc.
with the email address populated, all of our elevated accounts are tagged as false positive.
A better check to see if there is a mailbox or not linked to the account, is to check the msExchRecipientTypeDetails attribute, or any of the other exchagne attributes that shows a mailbox is linked to the account (homeMDB, msExchHomeServerName)
How do you currently solve the challenges you have by not having this feature?
Currently, we need to check all results from P-AdminEmailOn, and verify there is no mailbox configured, by checking the msExchRecipientTypeDetails attribute.
Increase the risk score from 0 to at least 10 points, when there is at least one admin with Microsoft Exchange-related mail attributes (for example MailboxId, LinkedMailbox, proxyAddresses, etc.). Add information to the admins wich property was detected.
Split the finding into two seperate findings:
a) Accounts that contain Microsoft Exchange-related mail attributes (for example MailboxId, LinkedMailbox, proxyAddresses, etc.) ā Risk Score: 10
b) Accounts that contain mail-related attributes such as mail or proxyAddresses but do not have valid mailbox information ā Risk Score: 0
I would prefer the combined more dynamic finding number 1 that describes both possibilities, as a customer might have e-mail servers that do not rely exchange server typical mailbox properties.
Why?
An attacker could use this information to identify potential targets and initiate email communication while impersonating with the administrative account. Given enough targets, it is likely that at least one recipient would unintentionally assist the attacker, providing an opportunity for further social engineering or privilege escalation.
Regardless of the chosen approach, the risk description should be improved to better explain the potential attack scenarios and resulting security risks.