New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Analyzing Office365 Audit Logs For Compromise

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

Apache-2.0Auto-check passedBackend & APIs

Install Analyzing Office365 Audit Logs For Compromise

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-office365-audit-logs-for-compromise -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-office365-audit-logs-for-compromise --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analyzing-office365-audit-logs-for-compromise .claude/skills/analyzing-office365-audit-logs-for-compromise && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
analyzing-office365-audit-logs-for-compromise
GitHub stars
34k
Token cost
~584 tokens
SKILL.md length
224 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

  • Works in 7 steps: Authenticate to Microsoft Graph using… → Query Unified Audit Log for suspicious… → Enumerate inbox rules across mailboxes… → …
  • Tasks that involve Cloud office suites
  • SKILL.md covers Overview, When to Use, Prerequisites and Steps, plus 1 more section
  • Runs Python scripts from its folder

What it does

Analyzing Office365 Audit Logs For Compromise is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

Its SKILL.md is about 580 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Backend & APIs, covering Cloud office suites, Email management and OAuth and OpenID Connect. It works with Microsoft 365. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Cloud office suites
  • Tasks that involve Email management
  • Tasks that involve OAuth and OpenID Connect

Example prompts

  • “/analyzing-office365-audit-logs-for-compromise”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Authenticate to Microsoft Graph using MSAL client credentials flow
  2. Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
  3. Enumerate inbox rules across mailboxes and flag forwarding rules
  4. Detect mailbox delegation changes (Add-MailboxPermission)
  5. Identify OAuth consent grants to suspicious applications
  6. Check for suspicious sign-in patterns from audit logs
  7. Generate compromise indicator report with timeline

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Analyzing Office365 Audit Logs For Compromise loads about 584 tokens when it runs, and up to ~1.3k if it reads all its reference files. Until then it costs about 60 tokens; SKILL.md has 224 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~60
When it runs · the whole SKILL.md, loaded when a task matches
~584
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 224 words, ~584 tokens.

Download SKILL.mdSave it as .claude/skills/analyzing-office365-audit-logs-for-compromise/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
analyzing-office365-audit-logs-for-compromise
description
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
domain
cybersecurity
subdomain
cloud-security
tags
Office365, Microsoft-Graph, audit-logs, email-compromise, inbox-rules, OAuth, BEC
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
PR.IR-01, ID.AM-08, GV.SC-06, DE.CM-01
mitre_attack
T1114.002, T1098.002, T1556.006, T1078.004

Analyzing Office 365 Audit Logs for Compromise

Overview

Business Email Compromise (BEC) attacks often leave traces in Office 365 audit logs: suspicious inbox rule creation, email forwarding to external addresses, mailbox delegation changes, and unauthorized OAuth application consent grants. This skill uses the Microsoft Graph API to query the Unified Audit Log, enumerate inbox rules across mailboxes, detect forwarding configurations, and identify compromised account indicators.

When to Use

  • When investigating security incidents that require analyzing office365 audit logs for compromise
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Azure AD app registration with AuditLog.Read.All, MailboxSettings.Read, Mail.Read (application permissions)
  • Python 3.9+ with msal, requests
  • Client secret or certificate for authentication
  • Global Reader or Security Reader role

Steps

  1. Authenticate to Microsoft Graph using MSAL client credentials flow
  2. Query Unified Audit Log for suspicious operations (Set-Mailbox, New-InboxRule)
  3. Enumerate inbox rules across mailboxes and flag forwarding rules
  4. Detect mailbox delegation changes (Add-MailboxPermission)
  5. Identify OAuth consent grants to suspicious applications
  6. Check for suspicious sign-in patterns from audit logs
  7. Generate compromise indicator report with timeline

Expected Output

  • JSON report listing forwarding rules, delegation changes, OAuth grants, and suspicious audit events with risk scores
  • Timeline of compromise indicators with affected mailboxes

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/analyzing-office365-audit-logs-for-compromise of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Analyzing Office365 Audit Logs For Compromise next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Analyzing Office365 Audit Logs For Compromise compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Analyzing Office365 Audit Logs For Compromise this skillmukul975/Anthropic-Cybersecurity-Skills34k—~584Automated safety check: PassApache-2.0
Google WorkspaceRedWoodOG/Hermes-Desktop177—~2.1kAutomated safety check: PassMIT
API GatewayCraftOS-dev/CraftBot3923 repos~7.1kAutomated safety check: PassMIT
Investigating M365 Entratrilwu/secskills157—~4.1kAutomated safety check: PassMIT
GCP Workspace Pivotwgpsec/AboutSecurity1.8k—~2.9kAutomated safety check: PassNone
Pp Workspace Adminmvanhorn/printing-press-library2.1k—~11kAutomated safety check: NotesApache-2.0

Similar skills

  • Google Workspace

    RedWoodOG/Hermes-Desktop

    Gmail, Calendar, Drive, Contacts, Sheets, and Docs integration via Python.

    177 GitHub stars~2.1k tokensUpdated 4 mo ago
    Backend & APIsAuto-check passed

  • API Gateway

    CraftOS-dev/CraftBot

    Connect to 100+ APIs (Google Workspace, Microsoft 365, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth.

    392 GitHub starsUsed in 3 repos~7.1k tokens
    Backend & APIsAuto-check passed

  • Investigating M365 Entra

    trilwu/secskills

    Investigate security incidents in Microsoft 365 and Entra ID (Azure AD) -- search the Unified Audit Log, correlate sign-in and audit events, trace illicit OAuth consent grants, analyze mailbox rule…

    157 GitHub stars~4.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

  • GCP Workspace Pivot

    wgpsec/AboutSecurity

    GCP 到 Google Workspace 的穿越攻击方法论。当已获取 GCP Service Account 或 Project 权限并发现目标组织使用 Google Workspace、需要从云平台穿越到企业邮件/文档/管理控制台、或发现 Domain-Wide Delegation 配置时使用。覆盖 Domain-Wide Delegation 滥用、OAuth…

    1.8k GitHub stars~2.9k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Pp Workspace Admin

    mvanhorn/printing-press-library

    GAT-style Google Workspace auditing as an agent-native CLI: sync Directory, Drive, Gmail, Reports, and Alert Center into a local store, then run offline cross-API audits, offboarding, and OAuth-app…

    2.1k GitHub stars~11k tokensUpdated yesterday
    Backend & APIsAuto-check: notes

  • Community Google Workspace

    ArgentAIOS/argentos-core

    Gmail, Calendar, Drive, Contacts, Sheets, and Docs integration for community skills.

    126 GitHub stars~2.8k tokensUpdated 3 mo ago
    Documents & OfficeAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Analyzing Office365 Audit Logs For Compromise

What does Analyzing Office365 Audit Logs For Compromise do?

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise. Analyzing Office365 Audit Logs For Compromise is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

When should I use Analyzing Office365 Audit Logs For Compromise?

Analyzing Office365 Audit Logs For Compromise fits situations like: tasks that involve Cloud office suites; tasks that involve Email management; tasks that involve OAuth and OpenID Connect.

How do I install Analyzing Office365 Audit Logs For Compromise in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-office365-audit-logs-for-compromise -a claude-code`. Or copy the skill folder (skills/analyzing-office365-audit-logs-for-compromise in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/analyzing-office365-audit-logs-for-compromise in your project. Claude Code loads it when a task matches its description.

How do I install Analyzing Office365 Audit Logs For Compromise in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-office365-audit-logs-for-compromise -a codex`. Or copy the skill folder (skills/analyzing-office365-audit-logs-for-compromise in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/analyzing-office365-audit-logs-for-compromise in your project. Codex loads it when a task matches its description.

Can I use Analyzing Office365 Audit Logs For Compromise in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-office365-audit-logs-for-compromise -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyzing-office365-audit-logs-for-compromise, .gemini/skills/analyzing-office365-audit-logs-for-compromise, .github/skills/analyzing-office365-audit-logs-for-compromise and .opencode/skills/analyzing-office365-audit-logs-for-compromise in your project.

What does Analyzing Office365 Audit Logs For Compromise need to run?

Going by SKILL.md and its folder, Analyzing Office365 Audit Logs For Compromise needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Analyzing Office365 Audit Logs For Compromise access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Analyzing Office365 Audit Logs For Compromise safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Analyzing Office365 Audit Logs For Compromise use?

Analyzing Office365 Audit Logs For Compromise is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Analyzing Office365 Audit Logs For Compromise use?

About 584 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 706 tokens, read only when the agent opens those files.

What are the alternatives to Analyzing Office365 Audit Logs For Compromise?

Skills that share tags, products or a category with Analyzing Office365 Audit Logs For Compromise: Google Workspace (RedWoodOG/Hermes-Desktop, 177 stars), API Gateway (CraftOS-dev/CraftBot, 392 stars), Investigating M365 Entra (trilwu/secskills, 157 stars) and GCP Workspace Pivot (wgpsec/AboutSecurity, 1.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Analyzing Office365 Audit Logs For Compromise?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.