Skip to content
cccskills
FreePublished on GitHub

analyzing-office365-audit-logs-for-compromise

Parse Office 365 Unified Audit Logs via Microsoft Graph API to tespit etmeemail forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

The English summary is being prepared. Showing the original description.

Works withAzure
See how to install

Files included (1)

  • SKILL.md2.6 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Analyzing Office365 Audit Logs for Compromise

Genel Bakış

Business Email Compromise (BEC) attacks often leave traces in Office 365 audit logs: suspicious inbox rule creation, email forwarding to external addresses, mailbox delegation changes, and unauthorized OAuth application consent grants. bu skill uses the Microsoft Graph API to query the Unified Audit Log, enumerate inbox rules across mailboxes, tespit etmeforwarding configurations, and identify compromised account indicators.

Ne Zaman Kullanılır

  • investigating yaparken security incidents that require analyzing office365 audit logs for compromise
  • building yaparken Tespit rules or threat hunting queries for this domain
  • SOC yaparken: analysts need structured procedures for this analysis type
  • validating yaparken security monitoring coverage for related attack techniques

Ön Gereksinimler

  • Azure AD app registration with AuditLog.Read.All, MailboxSettings.Read, Mail.Read (application permissions)
  • Python 3.9+ with msal, requests
  • Client secret or certificate for authentication
  • Global Reader or Security Reader role

Adımlar

  1. Authenticate to Microsoft Graph using MSAL client credentials flow
  2. Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
  3. Enumerate inbox rules across mailboxes and flag forwarding rules
  4. tespit etmemailbox delegation changes (Add-MailboxPermission)
  5. Identify OAuth consent grants to suspicious applications
  6. Check for suspicious sign-in patterns from audit logs
  7. Generate compromise indicator report with timeline

Expected Output

  • JSON report listing forwarding rules, delegation changes, OAuth grants, and suspicious audit events with risk scores
  • Timeline of compromise indicators with affected mailboxes
<!-- ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih Yetkisiz kullanim/kopyalama tespit edilebilir. hash: 6f4f1a0f883b759a -->

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

21st.dev Magic MCP — AI-powered UI component generation via natural language. Access to 21st.dev component library, SVGL brand logos, and real-time preview. Generate React/Tailwind components with /ui command.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

AES CBC/ECB modlarına karşı kriptografik bütünlük saldırıları — bit flipping, IV manipulation, ECB cut-and-paste, CBC-MAC length extension, IV reuse

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

AES-GCM ve ChaCha20-Poly1305 nonce yeniden kullanımı saldırısı — GF(2^128) polinom kök bulma ile Hash Key kurtarma ve MAC sahteciliği.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

tespit etmeabnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly Tespit.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to tespit etmereentrancy, integer overflow, access control, and other vulnerability classes before Dağıt:ment to Ethereum mainnet.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

Parses Kubernetes API server audit logs (JSON lines) to tespit etmeexec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat Tespit rules from audit event patterns. Use investigating yaparken Kubernetes cluster compromise or building k8s-specific SIEM Tespit rules.

The English summary is being prepared. Showing the original description.

MustafaKemal0146/fetih5Updated Oct 11, 2026

See all skills by MustafaKemal0146

Report a problem with this skill