This skill is designed for security professionals and SOC analysts who need to investigate potential compromises within Office 365 environments. By leveraging the Microsoft Graph API, it parses the Unified Audit Logs to identify suspicious activities such as the creation of email forwarding rules, changes to mailbox delegation, and unauthorized OAuth app grants. These indicators are critical in recognizing Business Email Compromise (BEC) attacks, which often exploit Office 365 features to facilitate unauthorized access and data exfiltration.

The skill begins by authenticating to Microsoft Graph using a client credentials flow, ensuring secure access to the necessary audit log data. Once authenticated, it queries the Unified Audit Log for specific operations that may indicate malicious behavior, such as Set-Mailbox and New-InboxRule. It systematically enumerates inbox rules across mailboxes to flag any forwarding configurations that direct emails to external addresses, which is a common tactic used by attackers.

In addition to monitoring inbox rules, the skill detects changes in mailbox delegation, which can signify unauthorized access to user accounts. It also identifies OAuth consent grants to suspicious applications, providing insights into potential misuse of permissions. The output is a comprehensive JSON report that lists these findings along with risk scores and a timeline of compromise indicators, enabling analysts to prioritize their response efforts effectively.

This skill is particularly useful in scenarios where organizations need to validate their security monitoring coverage and build detection rules for future threat hunting. It serves as a structured approach to analyzing Office 365 audit logs, making it an essential tool for those tasked with safeguarding enterprise email environments.