Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
Start a fresh conversation. Replace the highlighted placeholders.
Use analyzing-office365-audit-logs-for-compromise to analyze [authorized Microsoft 365 tenant] audit data for forwarding rules, delegation changes, suspicious OAuth grants, and sign-in indicators, and deliver a compromise-indicator timeline report. Use only authorized read access with the required Graph permissions and role.
Required inputs
[authorized Microsoft 365 tenant]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: analyzing-office365-audit-logs-for-compromisedescription: Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.domain: cybersecuritysubdomain: cloud-securitytags: - Office365- Microsoft-Graph- audit-logs- email-compromise- inbox-rules- OAuth- BECversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.IR-01- ID.AM-08- GV.SC-06- DE.CM-01mitre_attack: - T1114.002- T1098.002- T1556.006- T1078.004
Analyzing Office 365 Audit Logs for Compromise
Overview
Business Email Compromise (BEC) attacks often leave traces in Office 365 audit logs: suspicious inbox rule creation, email forwarding to external addresses, mailbox delegation changes, and unauthorized OAuth application consent grants. This skill uses the Microsoft Graph API to query the Unified Audit Log, enumerate inbox rules across mailboxes, detect forwarding configurations, and identify compromised account indicators.
When to Use
When investigating security incidents that require analyzing office365 audit logs for compromise
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Azure AD app registration with AuditLog.Read.All, MailboxSettings.Read, Mail.Read (application permissions)
Python 3.9+ with msal, requests
Client secret or certificate for authentication
Global Reader or Security Reader role
Steps
Authenticate to Microsoft Graph using MSAL client credentials flow
Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
Enumerate inbox rules across mailboxes and flag forwarding rules