What problem does it solve?
Email account compromise and business email compromise (BEC) often go undetected because attackers hide persistence in inbox forwarding rules, illicit OAuth consent grants, and legacy-protocol sign-ins. This Skill gives SOC analysts a structured procedure to find compromised Microsoft 365 and Google Workspace mailboxes before attackers exfiltrate data or commit payment fraud.
Core Features & Use Cases
- Inbox Rule Analysis: Enumerate mailbox rules via Microsoft Graph to find external forwarding, deletion rules, and keyword-matching rules targeting terms like "invoice" or "payment".
- Sign-In Anomaly Detection: Query Azure AD sign-in logs for impossible travel, suspicious locations, and unusual user agents such as python-requests or curl.
- OAuth Persistence Hunting: Audit consent grants and service principals for apps holding Mail.ReadWrite or Mail.Send permissions that survive password resets.
- Use Case: After a user reports a suspicious email, an analyst follows the steps to enumerate all three forwarding locations (inbox rules, transport rules, ForwardingSMTPAddress), cross-corroborate sign-ins with follow-on actions, and produce a JSON compromise report with severity ratings.
Quick Start
Investigate whether the mailbox [email protected] shows signs of compromise by checking its inbox rules, recent sign-in locations, and OAuth consent grants.
