Use PowerShell to Remove Phishing Emails from Users' Mailboxes in Office 365

-
Anyone on the blue team side of security thinks about how to prevent and train users not to click on phishing emails. Phishing emails are the initial vector for the vast majority of companies that fall victim to ransomware, and others harvest credentials to be used in data breaches.

Office 365 / Exchange Online provides built-in protections for anti-spam and anti-phishing efforts (including ATP), but these can also be combined with 3rd party external vendors such as Symantec, ProofPoint, Cisco, SOPHOS, and more. With these technologies in place the percentage of phishing emails that are received by your users drops significantly. Most provide protection even if an email gets through by screening links and attachments if a user clicks on them (in addition to your local AV software).

But because we know that some of the emails will get through and we want them deleted as soon as possible, we have two options:
  1. Send out an email asking people to be aware of a phishing email circulating the company and to delete it if received.
  2. Remove the email from users' mailboxes before they have a chance to open it.
It's this second option we'll be exploring in the rest of this post. It takes only minutes to setup and perform, and is a great addition to your anti-phishing toolkit.

However, the commands given here (especially the purging of emails as admin across your Office 365 tenant) are extremely powerful and should be used carefully. If you're unsure of what you're doing, stop, and read about the commands in Microsoft's documentation.

Prerequisites

        1. Use Office 365 / Exchange Online for your email provider and be a Global Administrator.
        2. Update PowerShell to at least v5.1.
3. Install the Exchange Online Remote PowerShell Module from Office 365:
Start-Process "iexplore.exe" "https://cmdletpswmodule.blob.core.windows.net/exopsmodule/Microsoft.Online.CSE.PSModule.Client.application"


Search & Purge

Launch the newly installed Exchange Online Remote PowerShell Module from PowerShell.
explorer.exe "$env:appdata\Microsoft\Windows\Start Menu\Programs\Microsoft Corporation\Microsoft Exchange Online Powershell Module.appref-ms"
A separate PowerShell window will appear -- your Exchange Online Remote PowerShell Module.

Connect to Office 365.
Connect-IPPSSession -UserPrincipalName <USERNAME>

Start a new Content Search in Office 365. The following search just uses the email subject, but additional filters can be added.
New-ComplianceSearch -Name "<NAME OF SEARCH>" -ExchangeLocation All -ContentMatchQuery 'Subject:"<EMAIL SUBJECT>")'

Start the Content Search we just created.
Start-ComplianceSearch "<NAME OF SEARCH>"

Check the status of the Content Search.
Get-ComplianceSearch -Identity "<NAME OF SEARCH>" | Format-Table -Auto Name,RunBy,JobEndTime,Status,Items

Purge the email from any location it is found. By default this performs a "Soft" delete, where the user can restore the email within Outlook. Additional parameters available for a "Hard" delete.
New-ComplianceSearchAction -SearchName "<NAME OF SEARCH>" -Purge

Check the status of the Purge.
Get-ComplianceSearchAction -Identity "<NAME OF SEARCH>_Purge"

Disconnect the current session.
Get-PSSession | Remove-PSSession

And the phishing email is gone! 

Comments

Post a Comment

Popular Posts

Hashcat - Cracking MD5 and NTLM Hashes

-
Image
Today we'll be exploring Hashcat -- "the world’s fastest and most advanced password recovery utility". This, along with similar tools, should be used only for password recovery, pentest engagements, CTFs, etc and never for illegal purposes. I could write an entire series about the capabilities Hashcat provides, but we will cover a few basic examples for now ( besides, Hashcat does a pretty good job of that themselves ): Crack MD5 hashes using the rockyou.txt wordlist. Crack NTLM hashes using the rockyou.txt wordlist. Crack NTLM hashes using a mask attack (modified brute force). I'll be using Kali Linux as Hashcat comes pre-installed, but Hashcat can run on Windows, macOS, and other Linux distributions as well. As you'll see, I'll be using some lists of hashes I made previously. Tools to generate hashes using dozens of algorithms are available online -- just save the output as a text file if you want to follow along. Cracking MD5 Hashes Using rockyou.txt Wordl...
Read more

Configuring Secure Ciphers Suites and TLS

-
Image
Hey everyone, today we're back on cipher suites. If you want a refresher of TLS and secure cipher suites overall, check out my previous post . There are many instances in which you'll need to edit cipher suites on a system -- compliance efforts, CIS benchmarks, or simply ensuring your system doesn't use insecure suites. There are a few ways to go about this and I'll detail two of them now: IIS Crypto and the Windows registry. IIS Crypto My favorite way of editing TLS versions and cipher suites is using IIS Crypto . IIS Crypto allows you to select your desired TLS/SSL version, cipher suites, and backup the registry, all with a few mouse clicks. Only downside is that it's Windows only (even the command line version). This is what IIS Crypto will look like on an unmodified Windows 10 system. Note the separate  Server Protocols  and  Client Protocols  sections. These are important to keep straight depending on what system is listening for connections and what system is ...
Read more

Configuring SSH Key Based Authentication

-
Image
Overview Most personal computers and many organizations running Linux servers utilize password-based authentication. This is what most of us are used to -- you enter a username and password in order to authenticate your account and gain access to a system. While straightforward and commonplace, this isn't the best solution in most cases. Today I'll be explaining why key based authentication is more convenient, more secure, and allows for automation of tasks without saving credentials in plain-text in a text file. Key based authentication involves the use of private and public keys ( public-key cryptography ). The private key is stored on the client and the public key is stored on the server in a special file ( ~/.ssh/authorized_keys ). This allows any system with the corresponding private key to login to the server where we just stored the public key. Our steps are: Generate key pair (public / private key). Transfer public key and add it to the authorized_keys file on the remot...
Read more