analyzing-office365-audit-logs-for-compromise
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
Best use case
analyzing-office365-audit-logs-for-compromise is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
Teams using analyzing-office365-audit-logs-for-compromise should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/analyzing-office365-audit-logs-for-compromise/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How analyzing-office365-audit-logs-for-compromise Compares
| Feature / Agent | analyzing-office365-audit-logs-for-compromise | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Analyzing Office 365 Audit Logs for Compromise ## Overview Business Email Compromise (BEC) attacks often leave traces in Office 365 audit logs: suspicious inbox rule creation, email forwarding to external addresses, mailbox delegation changes, and unauthorized OAuth application consent grants. This skill uses the Microsoft Graph API to query the Unified Audit Log, enumerate inbox rules across mailboxes, detect forwarding configurations, and identify compromised account indicators. ## When to Use - When investigating security incidents that require analyzing office365 audit logs for compromise - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Azure AD app registration with `AuditLog.Read.All`, `MailboxSettings.Read`, `Mail.Read` (application permissions) - Python 3.9+ with `msal`, `requests` - Client secret or certificate for authentication - Global Reader or Security Reader role ## Steps 1. Authenticate to Microsoft Graph using MSAL client credentials flow 2. Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule) 3. Enumerate inbox rules across mailboxes and flag forwarding rules 4. Detect mailbox delegation changes (Add-MailboxPermission) 5. Identify OAuth consent grants to suspicious applications 6. Check for suspicious sign-in patterns from audit logs 7. Generate compromise indicator report with timeline ## Expected Output - JSON report listing forwarding rules, delegation changes, OAuth grants, and suspicious audit events with risk scores - Timeline of compromise indicators with affected mailboxes