value:  APT41 employs a variety of persistence methods, one of which involved increasing a compromised account's privileges through the Office 365 Administrator role. 
name: Account Manipulation: Add Office 365 Global Administrator Role