O365 email security

The symptoms described match a compromised Microsoft 365 mailbox: attackers creating suspicious Inbox rules, adding forwarding, and sending messages from the account. MFA reduces risk, but the documented guidance is to investigate how the account was accessed and then remove all persistence the attacker may have added.

Recommended investigation path:

1. Review sign-in activity in the Microsoft Entra admin center. Check:
   • IP address
   • Sign-in locations
   • Sign-in times
   • Sign-in success or failure
2. Review audit logs from just before the first suspicious activity through the end of remediation. In the Defender portal, start with a broad date range and avoid filtering to specific activities in the initial search. This helps identify the exact window of compromise.
3. Review mailbox activity and sent mail.
   • Verify the contents of Sent Items in Outlook or Outlook on the web.
   • Use Message Trace in the Defender portal to identify what was sent during the suspicious period.
   • If mailbox auditing is enabled, review Exchange mailbox activities for unusual patterns such as odd access times, unusual IP addresses, or high volumes of moves, purges, or deletes.
4. Check for attacker persistence in the mailbox. Review and remove:
   • Suspicious Inbox rules
   • External forwarding
   • Mail flow or transport rules that redirect mail externally
   • Suspicious signatures or contact changes
5. Revoke active access immediately. Use Microsoft Graph PowerShell to revoke all active sessions and invalidate refresh tokens:

      Connect-MgGraph -Scopes User.RevokeSessions.All
      Revoke-MgUserSignInSession -UserId <UPN>
   

   If local script execution is blocked, the documented prerequisite is:

      Set-ExecutionPolicy RemoteSigned
   

   Risk: changing execution policy affects what scripts can run on that system, so use it only if required and in an elevated PowerShell session.
6. Reset credentials correctly.
   • Reset the user password.
   • If the account is synced from Active Directory, reset the password in Active Directory and reset it twice.
   • If the identity is federated, change the password in the on-premises environment.
   • Delete and recreate app passwords, because app passwords are not automatically revoked by a password reset.
7. Review MFA registrations and authentication methods. Remove any suspicious registered devices or unrecognized MFA methods.
8. Review consented applications. Remove and revoke any applications the user should not have granted access to.
9. Review privilege assignments. Check whether compromised users were assigned any administrative roles and remove any that should not be present.
10. If the mailbox was used to send spam and is now blocked from sending, remove the user from the Restricted entities page after remediation.

Security improvements to reduce recurrence:

• Enforce MFA for all users and require phishing-resistant MFA for admins.
• Monitor account access with Entra monitoring and health.
• Alert on patterns such as multiple failed logins, impossible travel, and unusual impersonated activity.
• Use Secure Score to review and improve account security posture.
• Block automatic external forwarding by creating a mail flow rule in Exchange admin.

For the forwarding control, the documented Exchange admin path is:

• Microsoft 365 admin center → Exchange → mail flow → rules
• Create a new rule
• Condition: sender is Inside the organization
• Add condition: The message properties → include the message type → Auto-forward
• Action: Block the message and reject it with an explanation

Common indicators to search for across affected users:

• Mailbox blocked from sending
• Missing or deleted mail
• Rules moving mail to Notes, Junk Email, or RSS Subscriptions
• New external forwarding
• Suspicious messages in Sent Items or Deleted Items
• Frequent password changes or unexplained lockouts
• Changes to GAL contact details

References:

• Respond to a compromised cloud email account
• Stop auto-forwarding emails in Office 365 Business Premium
• Phishing investigation
• Detect and remediate Outlook rules and custom forms injection attacks