Microsoft has a technology in Exchange Online known as ZAP. It will basically move known malicious emails, even after they may have initially been delivered to a mailbox. You can read more about the the technology here:
Zero-hour auto purge protection against spam and malware
ZAP however, is a ‘reactive’ security technology requiring knowledge of malicious content prior to taking action. There will therefore be cases when malicious content can get delivered to a mailbox, especially if the attack is relative new in the wild, simply because it has not yet been identified. Hopefully, users have been trained so they can report any suspicious material that they do find, as I have detailed here:
Improved security is a shared responsibility
You can also enable an alert that notifies when someone reports an email. When that happens, you may want to check through all the other mailboxes to see whether that malicious email occurs elsewhere. If the payload is indeed malicious, you may wish to take the pro-active step of deleting that bad email from all users inboxes.
You can achieve this using two steps:
1. Create a content search to locate the suspect item in your tenant
2. Use PowerShell to delete the discovered items
Step one is to login to the Microsoft 365 tenant as an administrator and visit the Security and Compliance Center like so:
Select Content Search from under the Search option on the left.
Before you create a new search, you’ll need to find something unique about the item you are searching for.
In the case above, with this dodgy email, I’ll do a search based on the senders email but I could as easily do one on the mis-spelled subject ‘Alart’. All you need is something unique.
If I look in my inbox I can see this email listed as shown.
I create a new Content Search and use the unique criteria in the keywords as shown above.
Below this I can limit where the search is conducted. In this case, I will specify messages, as that is what I am looking for. You can get quite granular here if you need to. Just select Modify and specify the location you wish to search. Remember, the more places you search the longer it will take to return results.
Once you have crafted your search, select Save & run in the lower left. After a short while, you should see the results. In this case, I have only found the one result, which is the item in my inbox. Make sure you check the items that are returned as it is these items that will be deleted! You may need to adjust your search to get exactly the results you wish.
Next, you’ll need to fire up PowerShell and connect to the Microsoft Security and Compliance Center for you tenant. I have a script that you can use here if you have MFA:
https://github.com/directorcia/Office365/blob/master/o365-connect-mfa-sac.ps1
and if you don’t (shame on you):
https://github.com/directorcia/Office365/blob/master/o365-connect-sac.ps1
Once you have successfully connected you need to run the following line of PowerShell:
New-ComplianceSearchAction -SearchName “<Content search query name>” -Purge -PurgeType SoftDelete
for a ‘soft delete’ of the item (i.e. recoverable). Or
New-ComplianceSearchAction -SearchName “<Content search query name>” -Purge -PurgeType HardDelete
for a ‘hard delete’ (i.e. non-recoverable). You’ll also need to change <Content search query name> to match the name you gave the Content Search when you created it.
You should now see a prompt, as shown above, asking you to confirm your actions. Generally, you’ll select Yes to All here.
This will kick off the process of deleting the content you have found. Note, this process is not immediate. It may take a little while to work through all the locations.
When the process is complete, as shown above, that item no longer appears in mailboxes.
That’s how you run your own ZAP!
CIAOPS 