# Analyzing Office365 Audit Logs For Compromise

> 通过 Microsoft Graph API 解析 Office 365 统一审计日志，检测邮件转发规则创建、收件箱委托、可疑 OAuth 应用授权以及其他账户失陷指标。

- **Type:** Skill
- **Install:** `agentstack add skill-killvxk-cybersecurity-skills-zh-analyzing-office365-audit-logs-for-compromise`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [killvxk](https://agentstack.voostack.com/s/killvxk)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [killvxk](https://github.com/killvxk)
- **Source:** https://github.com/killvxk/cybersecurity-skills-zh/tree/master/skills/analyzing-office365-audit-logs-for-compromise

## Install

```sh
agentstack add skill-killvxk-cybersecurity-skills-zh-analyzing-office365-audit-logs-for-compromise
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# 分析 Office 365 审计日志以检测账户失陷

## 概述

商业邮件欺诈（Business Email Compromise，BEC）攻击通常会在 Office 365 审计日志中留下痕迹：可疑的收件箱规则创建、将邮件转发到外部地址、邮箱委托更改以及未经授权的 OAuth 应用授权。本 skill 使用 Microsoft Graph API 查询统一审计日志，枚举各邮箱的收件箱规则，检测转发配置，并识别账户失陷指标。

## 前置条件

- Azure AD 应用注册，具备 `AuditLog.Read.All`、`MailboxSettings.Read`、`Mail.Read`（应用权限）
- Python 3.9+ 及 `msal`、`requests` 库
- 用于认证的客户端密钥或证书
- 全局读取者（Global Reader）或安全读取者（Security Reader）角色

## 步骤

1. 使用 MSAL 客户端凭据流向 Microsoft Graph 进行身份认证
2. 查询统一审计日志中的可疑操作（Set-Mailbox、New-InboxRule）
3. 枚举各邮箱的收件箱规则并标记转发规则
4. 检测邮箱委托更改（Add-MailboxPermission）
5. 识别向可疑应用程序的 OAuth 授权
6. 检查审计日志中的可疑登录模式
7. 生成包含时间线的失陷指标报告

## 预期输出

- JSON 报告，列出转发规则、委托更改、OAuth 授权以及带有风险评分的可疑审计事件
- 失陷指标及受影响邮箱的时间线

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [killvxk](https://github.com/killvxk)
- **Source:** [killvxk/cybersecurity-skills-zh](https://github.com/killvxk/cybersecurity-skills-zh)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-killvxk-cybersecurity-skills-zh-analyzing-office365-audit-logs-for-compromise
- Seller: https://agentstack.voostack.com/s/killvxk
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.