Add Get-HawkTenantAdminMailBoxPermissionChange function to include ru…

…les to flag for risky permissions (e.g. FullAaccess, SendAs, Send on Behalf). This is adds to the investigative techniques provided by hawk that were not included before.
T0pCyber · Dec 19, 2024 · e2cd6e6 · e2cd6e6
1 parent f009d4b
commit e2cd6e6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Hawk/functions/Tenant/Get-HawkTenantAdminMailboxPermissionChange.ps1 b/Hawk/functions/Tenant/Get-HawkTenantAdminMailboxPermissionChange.ps1
@@ -5,7 +5,7 @@ Function Get-HawkTenantAdminMailboxPermissionChange {
 
     .DESCRIPTION
         Searches the Unified Audit Log for mailbox permission changes and flags any grants
-        of FullAccess, SendAs, or Send on Behalf permissions for investigation.
+        of FullAccess, SendAs, or Send on Behalf permissions for investigations.
         Excludes normal system operations on Discovery Search Mailboxes.
 
     .OUTPUTS