bromiley / olaf

Office365 Log Analysis Framework
GNU General Public License v3.0
81 stars 14 forks source link

Get-ReadStatus #2

Open secabstraction opened 6 years ago

secabstraction commented 6 years ago

The script used to retrieve mail read status (GetReadStatus.ps1) is not forensically sound. Mail clients have to intentionally set this flag when the mail is read. Anyone writing malicious automation against MSGraph/EWS endpoints is likely not flagging messages as read and then marking them as unread. This would only return positive results for mail reads via an existing email client, e.g. Outlook.

https://msdn.microsoft.com/en-us/library/ee160304(v=exchg.80).aspx