원클릭으로 Manus에서 모든 스킬 실행

analyzing-office365-audit-logs-for-compromise

스타14

포크0

업데이트2026년 7월 2일 08:56

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

Estudely

Estudely/riftor

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Analyzing Office 365 Audit Logs for Compromise

Overview

Business Email Compromise (BEC) attacks often leave traces in Office 365 audit logs: suspicious inbox rule creation, email forwarding to external addresses, mailbox delegation changes, and unauthorized OAuth application consent grants. This skill uses the Microsoft Graph API to query the Unified Audit Log, enumerate inbox rules across mailboxes, detect forwarding configurations, and identify compromised account indicators.

When to Use

When investigating security incidents that require analyzing office365 audit logs for compromise
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Azure AD app registration with AuditLog.Read.All, MailboxSettings.Read, Mail.Read (application permissions)
Python 3.9+ with msal, requests
Client secret or certificate for authentication
Global Reader or Security Reader role

Steps

Authenticate to Microsoft Graph using MSAL client credentials flow
Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
Enumerate inbox rules across mailboxes and flag forwarding rules
Detect mailbox delegation changes (Add-MailboxPermission)
Identify OAuth consent grants to suspicious applications
Check for suspicious sign-in patterns from audit logs
Generate compromise indicator report with timeline

Expected Output

JSON report listing forwarding rules, delegation changes, OAuth grants, and suspicious audit events with risk scores
Timeline of compromise indicators with affected mailboxes

이 저장소의 다른 Skills

같은 저장소

abusing-dpapi-for-credential-access

Estudely/riftor

Extract DPAPI-protected secrets such as credentials and browser data offline and online.

2026-07-0214

abusing-shadow-credentials-for-privesc

Estudely/riftor

Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

2026-07-0214

analyzing-cloud-storage-access-patterns

Estudely/riftor

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly detection.

2026-07-0214

analyzing-ios-app-security-with-objection

Estudely/riftor

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

2026-07-0214

analyzing-kubernetes-audit-logs

Estudely/riftor

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.

2026-07-0214

analyzing-network-flow-data-with-netflow

Estudely/riftor

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.

2026-07-0214

name	analyzing-office365-audit-logs-for-compromise
description	Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
domain	cybersecurity
subdomain	cloud-security
tags	["Office365","Microsoft-Graph","audit-logs","email-compromise","inbox-rules","OAuth","BEC"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1114.002","T1098.002","T1556.006","T1078.004"]

Analyzing Office 365 Audit Logs for Compromise

Overview

When to Use

When investigating security incidents that require analyzing office365 audit logs for compromise
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Azure AD app registration with AuditLog.Read.All, MailboxSettings.Read, Mail.Read (application permissions)
Python 3.9+ with msal, requests
Client secret or certificate for authentication
Global Reader or Security Reader role

Steps

Authenticate to Microsoft Graph using MSAL client credentials flow
Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
Enumerate inbox rules across mailboxes and flag forwarding rules
Detect mailbox delegation changes (Add-MailboxPermission)
Identify OAuth consent grants to suspicious applications
Check for suspicious sign-in patterns from audit logs
Generate compromise indicator report with timeline

Expected Output

JSON report listing forwarding rules, delegation changes, OAuth grants, and suspicious audit events with risk scores
Timeline of compromise indicators with affected mailboxes