一键在 Manus 中运行任何 Skill

analyzing-office365-audit-logs-for-compromise

星标14

分支0

更新时间2026年7月2日 08:56

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

Estudely

Estudely/riftor

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Analyzing Office 365 Audit Logs for Compromise

Overview

Business Email Compromise (BEC) attacks often leave traces in Office 365 audit logs: suspicious inbox rule creation, email forwarding to external addresses, mailbox delegation changes, and unauthorized OAuth application consent grants. This skill uses the Microsoft Graph API to query the Unified Audit Log, enumerate inbox rules across mailboxes, detect forwarding configurations, and identify compromised account indicators.

When to Use

When investigating security incidents that require analyzing office365 audit logs for compromise
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Azure AD app registration with AuditLog.Read.All, MailboxSettings.Read, Mail.Read (application permissions)
Python 3.9+ with msal, requests
Client secret or certificate for authentication
Global Reader or Security Reader role

Steps

Authenticate to Microsoft Graph using MSAL client credentials flow
Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
Enumerate inbox rules across mailboxes and flag forwarding rules
Detect mailbox delegation changes (Add-MailboxPermission)
Identify OAuth consent grants to suspicious applications
Check for suspicious sign-in patterns from audit logs
Generate compromise indicator report with timeline

Expected Output

JSON report listing forwarding rules, delegation changes, OAuth grants, and suspicious audit events with risk scores
Timeline of compromise indicators with affected mailboxes

同仓库更多 Skills

同仓库

abusing-dpapi-for-credential-access

Estudely/riftor

Extract DPAPI-protected secrets such as credentials and browser data offline and online.

2026-07-0214

abusing-shadow-credentials-for-privesc

Estudely/riftor

Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

2026-07-0214

analyzing-cloud-storage-access-patterns

Estudely/riftor

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly detection.

2026-07-0214

analyzing-ios-app-security-with-objection

Estudely/riftor

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

2026-07-0214

analyzing-kubernetes-audit-logs

Estudely/riftor

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.

2026-07-0214

analyzing-network-flow-data-with-netflow

Estudely/riftor

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.

2026-07-0214

name	analyzing-office365-audit-logs-for-compromise
description	Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
domain	cybersecurity
subdomain	cloud-security
tags	["Office365","Microsoft-Graph","audit-logs","email-compromise","inbox-rules","OAuth","BEC"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1114.002","T1098.002","T1556.006","T1078.004"]

Analyzing Office 365 Audit Logs for Compromise

Overview

When to Use

When investigating security incidents that require analyzing office365 audit logs for compromise
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Azure AD app registration with AuditLog.Read.All, MailboxSettings.Read, Mail.Read (application permissions)
Python 3.9+ with msal, requests
Client secret or certificate for authentication
Global Reader or Security Reader role

Steps

Authenticate to Microsoft Graph using MSAL client credentials flow
Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
Enumerate inbox rules across mailboxes and flag forwarding rules
Detect mailbox delegation changes (Add-MailboxPermission)
Identify OAuth consent grants to suspicious applications
Check for suspicious sign-in patterns from audit logs
Generate compromise indicator report with timeline

Expected Output

JSON report listing forwarding rules, delegation changes, OAuth grants, and suspicious audit events with risk scores
Timeline of compromise indicators with affected mailboxes