Exchange Online - Email Inbox Manipulation & Forwarding
MDO Inbox Forwarding
Query
let start_date = now(-10h);
let end_date = now();
let user_id = ""; // enter here the user id
CloudAppEvents
| where Timestamp between (start_date .. end_date)
| where AccountObjectId == user_id
| where Application == @"Microsoft Exchange Online"
| where ActionType in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule", "UpdateInboxRules") //set new inbox rule related operations
| project Timestamp, ActionType, CountryCode, City, ISP, IPAddress, RuleConfig = RawEventData.Parameters, RawEventDataAbout this query
Explanation
The query is used to detect and investigate suspicious email inbox manipulation and forwarding activities in Exchange Online. It provides information on changes to the Exchange Online - Anti-spam outbound policy and sign-ins to Exchange Online with PowerShell. It also includes advanced hunting queries to find new inbox rule events, check common ISPs, countries/regions, and user agents for a user, identify if other users have created forward rules to the same destination, and analyze email forwarding activities.
Details
Alex Verboon
Released: January 28, 2024
Tables
OfficeActivity
CloudAppEvents
SigninLogs
AADNonInteractiveUserSignInLogs
EmailEvents
EmailUrlInfo
EmailAttachmentInfo
IdentityLogonEvents
Keywords
Exchange OnlineEmail Inbox ManipulationForwardingMITRE ATT&CKEmail CollectionEmail Forwarding RuleMicrosoft Defender XDROfficeActivityCloudAppEventsSet-HostedOutboundSpamFilterPolicyAutoForwardingModeSigninLogsAADNonInteractiveUserSignInLogsPowerShellAdvanced HuntingSet-MailboxNew-InboxRuleSet-InboxRuleUpdateInboxRulesRawEventDataISPCountryCodeCityUserAgentSuspicious Recipients ListThreat ExplorerEmailEventsSenderDisplayNameSenderFromAddressSenderObjectIdNetworkMessageIdEmailUrlInfoEmailAttachmentInfoForwarderNew-TransportRuleSet-TransportRuleIdentityLogonEventsAccountUpn
Operators
| where| mv-expand| extend| project| union| make-series| count| default| on| step| by| let| now| CloudAppEvents| OfficeActivity| SigninLogs| AADNonInteractiveUserSignInLogs| set-HostedOutboundSpamFilterPolicy| RawEventData| EmailEvents| EmailUrlInfo| EmailAttachmentInfo| IdentityLogonEvents