[pull] dev from KelvinTegelaar:dev#1070
Merged
Merged
Conversation
The BEC report only listed inbox rules that still exist on the mailbox, so rules an attacker created, used and then deleted were invisible. Add a user-scoped audit log search for rule create, change and remove events over the last 7 days, expose it as InboxRuleChanges, and flag surviving rules as RecentlyChanged. Also harden the run: audit log search failures and timeouts were killing the entire BEC run, so wrap the search in try/catch and degrade to partial results with a warning instead. Drop the unused high-volume MailboxLogin/UserLoggedIn operations from the tenant-wide search (nothing downstream consumed them) and log Get-InboxRule failures properly instead of a broken Write-Host.
# Conflicts: # Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1
## Problem The BEC investigation only lists inbox rules that **still exist** on the mailbox (`Get-InboxRule`). Attackers commonly create a rule, use it, and then delete it to cover their tracks — those rules were completely invisible in the report. Separately, when the unified audit log search failed or timed out, the exception killed the **entire** BEC run instead of producing a partial report. ## Changes - **New `InboxRuleChanges` field**: a user-scoped `Search-UnifiedAuditLog` for `New-InboxRule`, `Set-InboxRule`, `Remove-InboxRule` and `UpdateInboxRules` events over the last 7 days, so created/changed/deleted rules show up even if they no longer exist. - **`RecentlyChanged` flag on existing rules**: rules returned by `Get-InboxRule` are flagged when their name matches a 7-day audit event. (Inbox rules carry no timestamps, so name-matching is the best available signal; Outlook-client `UpdateInboxRules` events carry no rule name and stay unflagged.) - **Resilience**: the tenant-wide audit search is wrapped in try/catch — on failure it logs a warning and degrades to partial results instead of failing the whole run. `Get-InboxRule` failures now log via `Write-LogMessage` (the old `Write-Host` string concat was broken). - **Trimmed the tenant-wide search**: dropped `MailboxLogin`/`UserLoggedIn` operations — nothing downstream consumed them (`$PermissionsLog` filters to permission ops only) and sign-in events are high-volume, bloating the search. - Error-path result now includes `ExtractedAt` so the frontend gets a timestamp even on failure. ## Companion PR Frontend PR (displays `InboxRuleChanges` + `RecentlyChanged` in the BEC page and PDF report): KelvinTegelaar/CIPP#6281 This PR is safe to merge on its own — it only adds fields to the BEC result. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…moval on offboarding (#2129) - Fixes KelvinTegelaar/CIPP#6280 - Remove users from mail-enabled security groups during license removal on offboarding
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )