Skip to content
Threat Feed
Subscribe

Tag

Activesync

2 briefs RSS
medium advisory

New ActiveSync Allowed Device Added via PowerShell

The rule detects the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device, potentially allowing attackers to gain persistent access to sensitive email data by adding unauthorized devices.

Microsoft Defender XDR +4 exchange activesync powershell persistence
2r 3t
medium threat

Exchange PowerShell Used to Add New ActiveSync Allowed Device

An adversary may use the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device, potentially gaining persistent access to a user's email and sensitive information.

exploited Microsoft Exchange Server exchange powershell activesync persistence
2r 3t