Skip to content
Get packs

Office 365 Compromise Log Analysis

Scans Microsoft 365 audit logs for signs of hacked email accounts via Microsoft Graph.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent gains a structured procedure for checking a Microsoft 365 (Office 365) tenant for signs that an email account has been taken over, such as new inbox rules that forward mail to outside addresses, delegated mailbox access, and suspicious third-party app consents. It includes a Python script that connects to Microsoft Graph with an Azure app registration and queries audit and mailbox data, then the agent is guided to produce a JSON report and a timeline of indicators. The files are a SKILL.md instruction set plus a script excerpt and an API reference, so the analysis depends on the script and credentials you supply.

Great for

  • Security analysts or SOC teams investigating suspected business email compromise in Microsoft 365
  • Incident responders who want a repeatable checklist for mailbox compromise indicators
  • Engineers building detection or threat-hunting queries for Microsoft 365 audit data

Skip it if

  • People without Azure admin access or a Microsoft 365 tenant, since the skill cannot run without app credentials and reader roles (the skill is not useful without them)
  • Production-grade forensic evidence collection, because the files give a procedure but no validation, chain-of-custody handling or tested risk scoring logic

Try asking

  • “Check our Microsoft 365 tenant for inbox forwarding rules created in the last 30 days and list affected mailboxes.”
  • “Review audit logs for Add-MailboxPermission and New-InboxRule events and build a compromise timeline.”
  • “Identify OAuth consent grants to unfamiliar applications in our tenant and produce a JSON report.”
Step-by-step guide: how to use Office 365 Compromise Log AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-office365-audit-logs-for-compromise.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-office365-audit-logs-for-compromise.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-office365-audit-logs-for-compromise.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Use a dedicated read-only app registration and rotate its client secret after the investigation.
  • Review scripts/agent.py yourself before running it, since it executes locally and calls Microsoft login and Graph endpoints with your credentials.
  • Treat the output as leads to verify manually in the Microsoft Purview or Exchange admin portals rather than as a conclusive finding.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.