Office 365
Microsoft Office 365 cloud productivity suite including Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory. Logs are captured via the Office 365 Management Activity API.
Exchange
No description available.
inbox_rule_created
Records New-InboxRule operations where users create email forwarding rules, often with external forwarding to bypass administrator controls and exfiltrate sensitive data
mailbox_forwarding
Records Set-Mailbox operations that configure external email forwarding, a common data exfiltration technique where emails are automatically forwarded to external addresses
mailbox_permission_added
Records Add-MailboxPermission operations that grant mailbox access rights (FullAccess, SendAs, SendOnBehalf) to other users, providing persistent access that survives password resets