The settings attackers flip (the drift watchlist)
A compromised admin (or a well-meaning 'quick fix') targets a predictable set — and every one is in serv365's EXO scan:
| Setting | Malicious flip | Concept |
|---|---|---|
| AutoForwardingMode | Enable external auto-forward (exfil) | forwarding-controls |
| Anti-phish seeded users/domains | Remove the CEO from impersonation protection | antiphish |
| HostedContentFilter thresholds | Loosen spam/phish to let payloads in | eop-pipeline |
| Connectors | Add an outbound smart-host (redirect mail) | connectors |
| Accepted domain type | Flip to relay (open a routing hole) | accepted-domains |
| Transport rules | Add a bypass-filtering or copy-to-external rule | eop-pipeline |
| TABL | Allow the attacker's own domain | tenant-allow-block |
| DKIM | Disable signing (enable spoofing you) | spf-dkim-dmarc |
The insight this module has been building toward: mail security is a configuration STATE, and states drift — via attackers, via 'temporary' changes that outlive their reason, via the new admin who loosened something to close a ticket. The point-in-time audit ('we're configured correctly') is worth far less than the CONTINUOUS diff ('nothing changed that we didn't intend').
The meta-control
- Baseline: capture the intended state of every control (the scan's nightly snapshot IS this).
- Diff: canonicalise + compare (VOLATILE keys dropped) — every change surfaced with before/after.
- Attribute: the admin audit log names WHO; the change record names WHAT — an unexpected pairing is an incident, not a maintenance note.
- Alert on the watchlist: the settings above get priority alerting (serv365 posts drift cards) — the loosened phish policy pages someone at 2am, not at the next quarterly review.
- Verdicts on the retirements: EWS/SMTP-AUTH/POP stances evaluated against the changing defaults (the verdict engine) — posture that includes 'are you ready for what Microsoft is about to change'.
This is, not coincidentally, the entire serv365 thesis expressed as an Exchange concept: Microsoft changes defaults, admins change settings, attackers change settings — and the only defence that scales is continuous, attributed, alerted diff.
What to watch (proofs)
- The watchlist as alerts: the eight settings above wired to priority notification — the highest-signal subset of the drift feed.
- Change attribution coverage: % of config changes matched to an intended change record — below ~90% means unmanaged change is normal (and hides malicious change).
- Retirement-readiness verdicts: the EXO mappings' current verdicts (EWS, POP/TLS) — posture against Microsoft's clocks, on the tenant page.
- The drill: flip a benign setting, confirm the drift card lands with actor + before/after — your mail-security monitoring's real SLA, tested.