value:  SODINOKIBI, a REvil ransomware as a service (RaaS), can compromise accounts and achieve persistence through malicious code executed via privileges achieved via an account being upgraded to an administrator of Office 365. 
name: Account Manipulation: Add Office 365 Global Administrator Role