Расследование компрометации Office 365 через аудит-логи

★ 8.4 · security

analyzing-office365-audit-logs-for-compromise is a Claude Code skill that parses Office 365 Unified Audit Logs via Microsoft Graph API to detect indicators of business email compromise and cloud account takeover. It walks through the full investigation workflow: authenticating with MSAL client credentials, querying the Unified Audit Log for Set-Mailbox and New-InboxRule operations, enumerating inbox rules and flagging external forwarding, detecting delegation changes via Add-MailboxPermission, identifying unauthorized OAuth app consent grants, and reviewing suspicious sign-in patterns. Output is a JSON report with a compromise indicator timeline, affected mailboxes, and risk scores. Designed for SOC analysts and threat hunters validating Microsoft 365 security monitoring coverage against MITRE ATT&CK techniques T1114.002, T1098.002, T1556.006, and T1078.004.