Check Inbox Rules for a Hacker in Microsoft 365
How attackers use inbox rules and forwarding in a BEC, how to find them in the Unified Audit Log and with Get-InboxRule, and how to tell them from real ones.
Series
BEC techniques in Microsoft 365 logs
4 posts in this series. Read them in order or jump to any one.
- Check Inbox Rules for a Hacker in Microsoft 365
How attackers use inbox rules and forwarding in a BEC, how to find them in the Unified Audit Log and with Get-InboxRule, and how to tell them from real ones.
- AiTM Phishing Detection: Finding Token Replay in Entra ID
How AiTM phishing steals Microsoft 365 sessions despite MFA, and how to detect the token replay in Entra ID sign-in logs and the Unified Audit Log.
- Illicit Consent Grant: Investigating Rogue OAuth Apps
How to spot an illicit OAuth consent grant in the Unified Audit Log and Entra audit logs, which scopes matter, and how to remove the app's access.
- MailItemsAccessed: What It Proves (and What It Doesn't)
Reading MailItemsAccessed records in a BEC case: Sync vs Bind, InternetMessageId, throttling, licensing, and telling the attacker's reads from the user's.
All posts in this series
AiTM Phishing Detection: Finding Token Replay in Entra ID
How AiTM phishing steals Microsoft 365 sessions despite MFA, and how to detect the token replay in Entra ID sign-in logs and the Unified Audit Log.
Illicit Consent Grant: Investigating Rogue OAuth Apps
How to spot an illicit OAuth consent grant in the Unified Audit Log and Entra audit logs, which scopes matter, and how to remove the app's access.
MailItemsAccessed: What It Proves (and What It Doesn't)
Reading MailItemsAccessed records in a BEC case: Sync vs Bind, InternetMessageId, throttling, licensing, and telling the attacker's reads from the user's.