search

syne0 / osprey

Powershell Based tool for gathering information related to O365 intrusions and potential Breaches
MIT License
6 stars 2 forks source link

Update Get-OspreyUserHiddenRule #11

Closed syne0 closed 3 months ago

syne0 commented 4 months ago

A few problems with this, the main one being that I have not found a single case where a hidden inbox rule was actually used during a BEC. The script is problematic, in that it needs to use impersonation, doesn't work on an account with MFA, and uses EWS.

I really don't think this is sticking around, but if there's a better way to get this now that graph exists, it's worth looking at this.

I'll need to add a hidden inbox rule on one of my dev accounts to test this.

syne0 commented 3 months ago

flag in get-inboxrule to show hidden seems to work fine, added it to the normal user inbox rule function