Iranian University Phishing Campaign Extradition: Detecting and Remediating Mailbox Credential Harvesting and Mass Email Exfiltration

---
title: Suspicious Inbox Forwarding or Redirect Rule Creation via PowerShell
id: 4d9e2b71-8c3a-4f6d-b2e5-7a1c9d3f0e12
status: experimental
description: Detects creation of inbox rules with forwarding/redirect actions, a common persistence and collection mechanism after mailbox compromise (MITRE T1098.002 / T1114.003). Frequently used by Iranian-nexus actors to silently copy victim mail to external addresses.
references:
  - https://attack.mitre.org/techniques/T1098/002/
  - https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.collection
  - attack.t1098.002
  - attack.t1114.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdlet:
    CommandLine|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  selection_action:
    CommandLine|contains:
      - '-ForwardTo'
      - '-ForwardAsAttachmentTo'
      - '-RedirectTo'
  condition: selection_cmdlet and selection_action
falsepositives:
  - Helpdesk or Exchange administrators configuring transport or mailbox rules during legitimate onboarding
  - Automated provisioning scripts (baseline and exclude known admin hosts/accounts)
level: high
---
title: Legacy Protocol Authentication to Exchange (IMAP/POP) From Non-Standard Client
id: 8f3a6c24-1d5e-4b7a-9c81-2e6f0a4b8d35
status: experimental
description: Detects IMAP/POP authentication to Exchange Online, the primary channel for bulk mailbox sync after credential theft. Legacy protocols bypass MFA and conditional access and are the quiet enabler of mass email collection.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1114/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.collection
  - attack.t1078
  - attack.t1114
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ClientAppUsed:
      - 'IMAP4'
      - 'POP3'
      - 'SMTP'
      - 'Exchange Web Services'
      - 'Exchange ActiveSync'
      - 'Other clients'
  condition: selection
falsepositives:
  - Legitimate legacy mail clients and multifunction printers using SMTP AUTH (migrate and exclude; long-term goal is zero matches)
level: medium
---
title: Mailbox Export Request Initiated (Potential Bulk Email Collection)
id: b71f9e05-3c8d-4a26-9f54-1b8d2e6a0c49
status: experimental
description: Detects New-MailboxExportRequest execution, which can be abused to bulk-export mailbox contents to a PST file on a network share for exfiltration at scale.
references:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1114.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 'New-MailboxExportRequest'
  condition: selection
falsepositives:
  - Legitimate eDiscovery, legal hold, or migration operations (tune to expected admin accounts and maintenance windows)
level: high

// Hunt 1: Inbox rules forwarding or redirecting mail to external addresses (Office 365 audit)
// MITRE: T1098.002, T1114.003 — collection persistence after mailbox compromise
let lookback = 14d;
let internalDomains = dynamic(["yourdomain.edu", "yourdomain.com"]); // customize
OfficeActivity
| where TimeGenerated > ago(lookback)
| where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend RuleParams = tostring(Parameters)
| where RuleParams has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo")
| extend ForwardTarget = tostring(parse_json(RuleParams))
| where not(RuleParams has_any (internalDomains))
| project TimeGenerated, UserId, ClientIP, Operation, RuleParams
| order by TimeGenerated desc;

// Hunt 2: Legacy protocol (IMAP/POP/SMTP-AUTH) sign-ins succeeding — credential replay indicator
// MITRE: T1078 — these bypass MFA; any success here is a finding worth triaging
SigninLogs
| where TimeGenerated > ago(7d)
| where ClientAppUsed in ("IMAP4", "POP3", "SMTP", "Exchange Web Services", "Other clients")
| where ResultType == 0
| summarize SignInCount = count(),
            DistinctIPs = dcount(IPAddress),
            IPs = make_set(IPAddress, 10),
            Countries = make_set(LocationDetails.countryOrRegion, 10)
    by UserPrincipalName, ClientAppUsed
| where SignInCount > 50 or DistinctIPs > 3   // bulk sync patterns / geo-diverse replay
| order by SignInCount desc;

// Hunt 3: Mailbox access from IPs with no prior history for that user (possible credential replay)
// MITRE: T1078, T1114
let historical =
    OfficeActivity
    | where TimeGenerated between (ago(90d) .. ago(8d))
    | where OfficeWorkload == "Exchange"
    | summarize KnownIPs = make_set(ClientIP) by UserId;
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload == "Exchange"
| where Operation in ("MailItemsAccessed", "Bind", "Sync") // Bind/Sync = thick-client or IMAP sync
| join kind=leftouter historical on UserId
| where isnull(KnownIPs) or not(set_has_element(KnownIPs, ClientIP))
| summarize AccessCount = count(), Operations = make_set(Operation) by UserId, ClientIP
| where AccessCount > 100   // volume consistent with bulk collection, not casual reads
| order by AccessCount desc;

-- Hunt for credential-phishing HTML artifacts (cloned login pages) saved to endpoints
-- and suspicious HTML files recently written to user-writable locations.
-- Phishing kits against universities are frequently opened from email attachments
-- or cached locally; this surfaces the endpoint-side residue of the lure.
SELECT
    FullPath,
    Size,
    Mtime AS ModifiedTime,
    Btime AS CreatedTime
FROM glob(
    globs=[
        'C:/Users/*/Downloads/*.html',
        'C:/Users/*/Desktop/*.html',
        'C:/Users/*/AppData/Local/Temp/*.html'
    ]
)
WHERE ModifiedTime > now() - (14 * 24 * 3600)
  AND FullPath !~ '(?i)google|microsoft|office|adobe'
ORDER BY ModifiedTime DESC

-- Companion hunt: recently executed processes from user-writable temp locations
-- (post-credential-theft tooling, archive staging for exfil)
SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE Exe =~ '(?i)\\AppData\\(Local\\Temp|Roaming)\\'
   OR CommandLine =~ '(?i)(rar|7z|zip).*a .*\\Users\\.*\\(Documents|Desktop|AppData)'
ORDER BY CreateTime DESC

# ============================================================
# Mailbox Compromise Audit & Hardening — Exchange Online / M365
# Run from an elevated Exchange Online PowerShell session
# (Connect-ExchangeOnline first). Read-only audit + targeted fixes.
# ============================================================

# --- 1. AUDIT: Find all inbox rules forwarding/redirecting externally ---
Write-Host "[*] Auditing inbox forwarding rules across all mailboxes..." -ForegroundColor Cyan
$suspiciousRules = Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    $mbx = $_.PrimarySmtpAddress
    Get-InboxRule -Mailbox $mbx -ErrorAction SilentlyContinue | Where-Object {
        $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo
    } | Select-Object @{n='Mailbox';e={$mbx}}, Name, ForwardTo, ForwardAsAttachmentTo, RedirectTo
}
$suspiciousRules | Export-Csv -Path ".\ExternalForwardingRules_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
$suspiciousRules | Format-Table -AutoSize

# --- 2. AUDIT: Confirm Unified Audit Log + MailItemsAccessed is enabled ---
Write-Host "[*] Checking audit configuration..." -ForegroundColor Cyan
$auditConfig = Get-AdminAuditLogConfig
Write-Host "UnifiedAuditLogIngestionEnabled: $($auditConfig.UnifiedAuditLogIngestionEnabled)"
if (-not $auditConfig.UnifiedAuditLogIngestionEnabled) {
    Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
    Write-Host "[+] Unified Audit Log ingestion ENABLED." -ForegroundColor Green
}

# --- 3. HARDEN: Disable legacy authentication org-wide ---
# Create/apply an authentication policy blocking IMAP, POP, SMTP AUTH, EWS legacy
Write-Host "[*] Blocking legacy authentication protocols..." -ForegroundColor Cyan
$policyName = "Block-Legacy-Auth"
if (-not (Get-AuthenticationPolicy -Identity $policyName -ErrorAction SilentlyContinue)) {
    New-AuthenticationPolicy -Name $policyName `
        -AllowBasicAuthImap $false `
        -AllowBasicAuthPop $false `
        -AllowBasicAuthSmtp $false `
        -AllowBasicAuthWebServices $false `
        -AllowBasicAuthPowershell $false `
        -AllowBasicAuthActiveSync $false
}
Get-Mailbox -ResultSize Unlimited | Set-Mailbox -AuthenticationPolicy $policyName
Write-Host "[+] Legacy auth blocked for all mailboxes." -ForegroundColor Green

# --- 4. HARDEN: Disable automatic external forwarding at the transport level ---
Write-Host "[*] Disabling automatic forwarding to external domains..." -ForegroundColor Cyan
Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off
Write-Host "[+] External auto-forwarding disabled (AutoForwardingMode = Off)." -ForegroundColor Green

# --- 5. VERIFY: List mailboxes with forwarding SMTP addresses set ---
Write-Host "[*] Checking mailbox-level forwarding (ForwardingSmtpAddress)..." -ForegroundColor Cyan
Get-Mailbox -ResultSize Unlimited |
    Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Select-Object PrimarySmtpAddress, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward |
    Format-Table -AutoSize

# --- 6. AUDIT: Recent MailItemsAccessed / suspicious operations (last 7 days) ---
Write-Host "[*] Searching audit log for mailbox export and mass-access events..." -ForegroundColor Cyan
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
    -Operations "New-MailboxExportRequest","MailItemsAccessed","UpdateInboxRules" `
    -ResultSize 5000 |
    Export-Csv -Path ".\MailboxAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "[+] Audit exports written to working directory. Review for anomalies." -ForegroundColor Green