Exchange Online Monitoring

Email is a critical communication channel in any organisation, which makes it a prime target for attackers. Once a mailbox is compromised, attackers can read emails, exfiltrate sensitive data, and even weaponise the account to launch different phishing campaigns. This room will explore how attackers abuse Microsoft Exchange Online post-compromise and how SOC analysts can detect these attacks using Splunk.

Learning Objectives

• Understand how Exchange Online generates logs and where to find them
• Identify suspicious mailbox rules creation and email forwarding
• Detect phishing campaigns launched from compromised mailboxes
• Use message trace and audit logs to scope an incident
• Investigate a real-world Exchange Online compromise

Prerequisites

• Entra ID Monitoring

Lab Access

Start the lab by clicking the Start Machine button below. You will then have access to the Splunk Web Interface. Please wait 4-5 minutes for the Splunk instance to launch. To access Splunk, please wait for the VM to start and follow this link:

• https://LAB_WEB_URL.p.thmlabs.com (opens in new tab)

The tasks that require working in Splunk have their own index and log datasets, so ensure you filter for the correct index and task number to answer the questions properly. The indices are given at the end of each practical task.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine