Updated script to now check for Sweep

pexels-photo-1433350

The bad actors out there are clever and they’ll use any means at their disposal. Normally, when a user is successfully phished the first thing bad actors do is manipulate the email handling rules of the mailbox to hide their activity.

Unfortunately, there are quite a lot of different ways to forward email in Office 365 including via the mailbox and via Outlook client rules. It was brought to my attention that there is in fact another way that forwarding can be done, using the Sweep function. You can read more about this ability at:

Organize your inbox with Archive, Sweep and other tools in Outlook.com

Sweep rules only run once a day but do provide a potential way for bad actors to hide their activity, however as it turned out Sweep was in fact being exploited by bad actors inside a compromised mailbox.

I have therefore updated my publicly available PowerShell script at:

https://github.com/directorcia/Office365/blob/master/o365-exo-fwd-chk.ps1

That will now also check and report on any Sweep rules in finds in mailboxes as well as any other forwards configured in the tenant.

Let me know if you find any other methods that this doesn’t cover and I’ll look at incorporating those as well.

Enabling modern authentication in Office 365 script

Just a quick note to let you know that I have uploaded another short script to make life a bit easier. This one will enable modern authentication in a tenant for Exchange Online and Skype for Business Online (it is already on for SharePoint Online).

Modern authentication basically prevents multiple logins when using multi factor authentication for desktop apps like Outlook and Skype for Business client. You can read more about this here:

How modern authentication works for Office 2013 and Office 2016 client apps

Enabling modern authentication will also impact older clients like Office 2010, so enable it on your tenant with the understanding that when you do you really should be running the latest version of Office on all desktops.

That said, you can find my script here:

https://github.com/directorcia/Office365/blob/master/o365-modern-auth.ps1

Note, that you’ll need to have connected to Exchange Online and Skype for Business online in PowerShell for the script to execute correctly.

PowerShell script to check Outlook mail rules

image

After I finished the recent PowerShell script to check for Exchange style mailbox forwards I received some motivate from Robert Pearman to develop a script to also go and check what the Outlook rules are doing for Office 365 mailboxes.

Taking what Robert provided I decided to extend my initial script to report on what I consider suspect Outlook mail rules. Here’s my thinking:

– Firstly there are going to potentially be lots and lots of Outlook rules when you look across all mailboxes in Office 365, so I decided to focus on actions that one could deem to more suspicious than others. I settled on the following rule actions as ones to check: forward to, redirect to, copy to folder, delete message, forward as attachment to and send text message notification to.

–  Turns out you can create an Outlook rule that forwards, redirects and fowards as an attachment messages to alternate email addresses. A bad party could set this up to send themselves emails from a compromised mailbox.

– If a rule copies rather than moves a message then that to me is also suspicious. Why would you want two copies of the same email message in different locations in your inbox unless you aren’t in full full control of the inbox and someone is squirrelling away messages to a location the owner never created?

– If a rule deletes a message then there is a chance that a bad actor is trying to prevent the mailbox owner from seeing something.

– If a rule notifies someone via SMS that may be the fingerprint of a bad actor trying to keep tabs on a mailbox.

I will also admit, that there are plenty of situations where the above situations are the results of legitimately configured inbox rules. However, for the reasons I have indicated, I believe the actions to warrant the most inspection.

As you can see from the above image, the script will do what it did before and check the mailbox rules to see if there are any forwardings as before but now the script will also dig through each mailbox and throw up warnings when a suspect rule is enabled or disabled for a user.

Once you have located any suspect rules, you can then start digging further to see whether there is a business justification for such. If not, then you may have a compromised mailbox on your hands.

You’ll find the updated script at:

https://github.com/directorcia/Office365/blob/master/o365-exo-fwd-chk.ps1

and remember to keep coming back as I’ll continue to update and extend it over time. if you have any feedback on this script of suggestion for things you’d like to see please let me know so I can look at developing them. Thanks again to Robert Pearman for this input on this.

Enabling Office 365 mailbox auditing

You may not be aware that by default Office 365 mailbox auditing isn’t turned on. Don’t believe me? Well check out this article, especially the first paragraph:

Enable mailbox auditing in Office 365

which says:

In Office 365, you can turn on mailbox audit logging to log mailbox access by mailbox owners, delegates, and administrators. By default, mailbox auditing in Office 365 isn’t turned on. That means mailbox auditing events won’t appear in the results when you search the Office 365 audit log for mailbox activity. But after you turn on mailbox audit logging for a user mailbox, you can search the audit log for mailbox activity. Additionally, when mailbox audit logging is turned on, some actions performed by administrators, delegates, and owners are logged by default.

If you want to check your own tenant then connect to Exchange Online with PowerShell and run this command:

get-mailbox | select userprincipalname,auditenabled

You’ll probably see that all the mailboxes don’t have auditing enabled.

To enable auditing, simply run this command:

Get-Mailbox -ResultSize Unlimited | Set-Mailbox -AuditEnabled $true

and then run the first command again to verify it is now enabled for all mailboxes.

You also need to appreciate that out of the box, not all items are audited and you may need to adjust these options, also using PowerShell. The options you can audit for are:

Mailbox auditing actions

I’ll cover how to set these in an upcoming article.

Configuring an Office 365 SPAM filtering policy with PowerShell

I recently wrote an article that shows you how to configure the spam policy in Office 365 using the web interface. If you missed that you can find it here:

Configuring an Office 365 SPAM filtering policy

Doing this multiple times via the web interface is a lot of work. A better approach is to use PowerShell. So once, how have connected to Exchange Online PowerShell, run these two commands:

$policyparams = @{
“name” = “Configured Policy”;
‘Bulkspamaction’ =  ‘movetojmf’;
‘bulkthreshold’ =  ‘7’;
‘highconfidencespamaction’ =  ‘movetojmf’;
‘inlinesafetytipsenabled’ = $true;
‘markasspambulkmail’ = ‘on’;
‘increasescorewithimagelinks’ = ‘off’
‘increasescorewithnumericips’ = ‘on’
‘increasescorewithredirecttootherport’ = ‘on’
‘increasescorewithbizorinfourls’ = ‘on’;
‘markasspamemptymessages’ =’on’;
‘markasspamjavascriptinhtml’ = ‘on’;
‘markasspamframesinhtml’ = ‘on’;
‘markasspamobjecttagsinhtml’ = ‘on’;
‘markasspamembedtagsinhtml’ =’on’;
‘markasspamformtagsinhtml’ = ‘on’;
‘markasspamwebbugsinhtml’ = ‘on’;
‘markasspamsensitivewordlist’ = ‘on’;
‘markasspamspfrecordhardfail’ = ‘on’;
‘markasspamfromaddressauthfail’ = ‘on’;
‘markasspamndrbackscatter’ = ‘on’;
‘phishspamaction’ = ‘movetojmf’;
‘spamaction’ = ‘movetojmf’;
‘zapenabled’ = $true
}

new-hostedcontentfilterpolicy @policyparams

The first basically sets up an array of all the parameters you are going to see into the spam policy. It makes it easier to adjust if you need to.

The second command creates a new policy based off this array that will be called ‘Configured Policy’.

However, after running these two commands you aren’t quite done yet because you have created the policy BUT you actually need to create a rule that uses this policy to do that use the following:

$ruleparams = @{
‘name’ = ‘Configured Recipients’;
‘hostedcontentfilterpolicy’ = ‘Configured Policy’;
## this needs to match the above policy name
‘recipientdomainis’ = ‘domain.com’;
## this needs to match the domains you wish to protect in your tenant
‘Enabled’ = $true
}

New-hostedcontentfilterrule @ruleparams

You’ll need to ensure the policy names match as noted and you include the domains you wish to protect.

image

Once this has been completed, if you go and look in your Exchange Admin area, under protection and spam filter, you should see a new policy called ‘Configured Recipients’ that was created by the above script commands.

Save the script away and run it as many times as you need. That should make life easier!

Configuring an Office 365 SPAM filtering policy

A common complaint I hear about Office 365 from IT Professionals is that it doesn’t filter spam as well as other third party solutions. My immediate question at that point is always “Well, have you actually gone in and configured ANY of the spam settings in Office 365 to improve your results?” to which the answer is always No. Thus, if you don’t take the time to customise what you get out of the box you’ll only get an out of the box solution which is probably not what you want! Thus, some configuration is required for EVERY Office 365 tenant to improve its spam filtering abilities.

The out of the box spam settings for Office 365 are not configured in an aggressive manner and you should go in and make changes from the defaults I would suggest. Here’s how to do that.

image

You’ll firstly need to login to the Office 365 portal as an administrator with rights to make changes. You’ll need to then navigate to the Office 365 Admin Center and select from the Admin centers on menu on the left hand side. You’ll find the Admin centers option right at the bottom.

From the list of options that now appear select Exchange as shown above.

image

This will take you to the Exchange Admin center as shown above. In here select the protection option on the left and then spam filter on the right.

You will then typically see a single policy called Default.

image

With this default policy selected, press the edit button (pencil) from the menu to view what settings this default policy has.

SNAGHTML58800d3

Select the different menu options on the left to view all the settings. Most you will see, like in the advanced settings shown above, are set to off.

You can of course edit this default policy, however it is better practice to go back to the list of policies and create a new one and leave the default one in place.

image

When you create a new policy using the plus button (+) a new dialog will appear like show above.

Give the new policy a name and now scroll through the settings to configure them for your needs.

image

image

image

image

image

When you reach the advanced options towards the bottom you’ll see a number of options that can set on or off. The crowd sourced results I obtained for these were:

Image links to remote sites = OFF

Numeric IP addresses = ON

URL redirect to other port = ON

URL to .biz or .info websites = ON

Empty messages = ON

Javascript or VBScript in HTML = ON

Frame or iFrame tags in HTML = ON

Object tags in HTML = ON

Embed tags in HTML = ON

Form tags in HTML = ON

Web bugs in HTML = ON

Apply sensitive word list = ON

SPF record hard fail = ON

Conditional sender ID hard fail = ON

NDR backscatter = ON

image

You can then set whether the policy will simply run in test mode if you wish.

image

The final option is to determine where this policy will apply. Normally you want this across all your domains and users but as you see, you can have different policies for different users and domains if you wish.

All you now need to do is save the policy and start monitoring the results.

Hopefully, you can now see that out of the box Office 365 does take a very relaxed approached to spam which is not uncommon for most spam protection products. You can, and should, of course go in and configure the available options to be more restrictive. When you do this you will of course get much better results.

This post showed you how to make spam filter setting via the web interface, a much better and more consistent approach across many tenants is to do this using PowerShell. Look out for an upcoming article on this.

SPAM filtering Office 365–Help shape a best practice

image

I hear a lot of people say that they don’t find Office 365 anti-spam filtering as good as other providers. My reply to that is – “Have you ever actually gone in and configured the settings from what is there by default?”. Unsurprisingly, the answer is always No.

The out of the box spam settings you get with Office 365 are designed for the “average” and probably configured for the least business interruption (i.e. less aggressive classification of what is spam). Thus, to get the optimal level of filtering you desire, it is recommended that you go and set the options the way that you want.

I have configured my tenant for the way I wish to handle spam but that is probably not exactly the best place for people to start. So with that in mind I thought that I’d call on the power of the crowd and offer up a survey were people can nominate what they consider to be major indicators of spam, based on the policy options that Microsoft provide. You’ll find that survey here:

http://bit.ly/o365spam

which I encourage you to fill out and share with everyone else.

The idea is that once the results are in I report back on an overall “best practices” starting policy that the majority would feel comfortable with. I can then also show you how to exactly configure that in Office 365.

So please take a moment to complete the survey and share you expertise and thought on the ‘best practice’ approach of configure anti-spam policies in Office 365.

You can find the details on the specific advanced spam filtering options in Office 365 here:

http://technet.microsoft.com/en-us/library/jj200750(v=exchg.150).aspx

Recalling message options in Office 365 OWA

image

There are many times when you want to recall a message you have sent in Outlook or Outlook Web Access (OWA). Generally, you should reconcile yourself to the fact that you won’t be able to achieve this but there is an option in OWA that you can set to allow you to ‘Undo’ you send.

To enable ‘Undo send’ in OWA navigate to OWA in your browser and select the Cog in the top right as shown above.

image

In the search box that appears type ‘undo’ and this should display the Undo send option as shown. Click on this result to navigate to the setting.

image

In most cases the Undo send option will be disabled as shown above. To enable simple select the Let me cancel messages I’ve sent for option.

image

By default, the time you have to undo the send is only 10 seconds so you may want to extend this to the maximum of 30 seconds by selecting that option from the pull down.

image

After you have made these changes make sure you select the Save button at the top to update your preferences.

With this option now configured at least you might have the ability to undo a sent email before it goes out. Again, this may not always work but at least now you have an option.