Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #As a part of determining if any of our 2000+ mailboxes have been phished, we've started scanning a report of any new or changed inbox rules.
- $RuleLogs = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-14) -EndDate (Get-Date) -Operations @('New-InboxRule', 'Set-InboxRule')
- [array]$entries = @()
- foreach ($entry in $RuleLogs)
- {
- $entry | Select CreationDate, UserIds, Operations, `
- @{l = 'Rule'; e = { (($entry.AuditData | ConvertFrom-Json).Parameters | ? { $_.Name -eq "Name" }).Value }}, `
- @{ l = 'Description'; e = { (Get-InboxRule (($entry.AuditData | ConvertFrom-Json).Parameters | ? { $_.Name -eq "Name" }).Value -Mailbox $_.UserIds) | select -expandproperty description }} `
- | Export-Csv c:\temp\14DayRules_Description.csv -append -notypeinformation
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement