Exchange Online Investigation Playbook

DFIR Investigation Charter

The Core of Business Email Compromise (BEC): Exchange Online remains the primary operational target in financial fraud, executive impersonation, invoice manipulation, and internal spear-phishing. This playbook details the low-level forensic mechanics required to reconstruct attacker email interactions, decipher MailItemsAccessed records, track message flow deletions, and audit the Recoverable Items partition.

1. Exchange Online Forensic Architecture

When analyzing a compromised Exchange Online mailbox, investigators must understand how message objects are created, accessed, modified, and purged within the underlying Exchange Store Driver.

graph TD
    subgraph ClientAccess ["Client Access Layer"]
        MAPI["Outlook Desktop (MAPI-HTTP)"]
        OWA["Outlook on the Web (REST/HTTP)"]
        Mobile["Mobile Outlook / ActiveSync"]
        API["EWS / Microsoft Graph API"]
    end

    subgraph MailboxStore ["Exchange Online Mailbox Architecture"]
        ActiveFolder["Visible IPM Subtree<br/>(Inbox, Sent Items, Drafts, Custom Folders)"]
        RecoverableItems["Recoverable Items Partition (Non-IPM)<br/>(Deletions, Purges, DiscoveryHolds, Versions)"]
        SubstrateFolder["Hidden Substrate Root<br/>(TeamsChat, Yammer, Conversation History)"]
    end

    subgraph AuditPipeline ["Purview Auditing & Telemetry"]
        MIA["MailItemsAccessed (Sync & Bind)"]
        MessageOps["Send, SendAs, Move, SoftDelete, HardDelete"]
        MsgTrace["Exchange Message Trace (MTA Logs)"]
    end

    ClientAccess --> ActiveFolder
    ActiveFolder -->|Delete| RecoverableItems
    ClientAccess --> AuditPipeline

Critical Mailbox Audit Operations

Operation	Triggering Action	Crucial Payload Fields	Forensic Significance
MailItemsAccessed	Message read via OWA/Mobile, or bulk synchronized via MAPI/EWS	OperationProperties (IsThrottled), ItemCount, InternetMessageId	Distinguishes between individual reading and bulk mailbox scraping
Send / SendAs	Message transmitted by owner or delegate	Item, SendAsUser, Recipients, Subject	Identifies attacker-dispatched BEC lures or internal phishing
MoveToDeletedItems	Message moved to Deleted Items folder	FolderPathName, AffectedItems	Evidence of attacker hiding security notifications or NDRs
SoftDelete	Item deleted from Deleted Items (moved to Deletions)	AffectedItems, ItemCount	Stage 1 deletion; item still recoverable
HardDelete	Item permanently purged (Shift+Delete or purged from Deletions)	AffectedItems, ItemCount	Stage 2 deletion; captured in Purges or DiscoveryHolds if LitHold is active
SearchQueryPerformed	User or attacker executes search in mailbox	QueryText, SearchApplication	Identifies attacker intelligence collection priorities

---

2. Deciphering MailItemsAccessed: Sync vs Bind

As established in Fiche 17: Mailbox Auditing & MailItemsAccessed, MailItemsAccessed operates under two fundamentally different interaction models:

flowchart TD
    MIA[MailItemsAccessed Event] --> Type{Operation Type}
    Type -->|Bind| BindProc[Individual Item Read via OWA / Mobile]
    Type -->|Sync| SyncProc[Bulk Sync via MAPI / EWS / ActiveSync]

    BindProc --> BindAudit[Audit log captures exact InternetMessageId and Subject]
    SyncProc --> CheckThrottle{IsThrottled == True?}

    CheckThrottle -->|No| SyncList[Complete list of synced InternetMessageIds in Folders block]
    CheckThrottle -->|Yes| ThrottleWarning[Throttled! Entire folder must be assumed compromised]

1. Bind Operations (OperationType = Bind)

• Occurs when an attacker opens an individual email in Outlook on the Web (OWA) or previews it in an email client.
• The UAL record contains the specific InternetMessageId, Subject, and folder path of the accessed item.
• Investigative Value: High precision; proves exactly which email was read.

2. Sync Operations (OperationType = Sync)

• Occurs when an email client (Outlook Desktop, mobile client, or automated script via EWS/Graph) synchronizes folder contents.
• The Throttling Threshold: If a sync operation accesses more than 1,000 items in a folder within a 24-hour window, Exchange Online throttles auditing for that folder and sets:

  "IsThrottled": "True"

• The Legal Presumption: When IsThrottled: True is encountered, forensic investigators cannot prove which specific items were extracted. Legally and forensically, every message in that folder must be presumed accessed.

---

3. The Recoverable Items Partition & Anti-Forensics Triage

When adversaries compromise a mailbox, their first defensive maneuver is concealing malicious activity:

1. Deleting bank wire change confirmation emails.
2. Deleting Non-Delivery Reports (NDRs) resulting from password spray campaigns.
3. Deleting security warning alerts from Microsoft Identity Protection.

Recoverable Items Folder Structure

The Recoverable Items partition resides in the non-IPM subtree of the mailbox and is invisible to standard MAPI/OWA views:

• Deletions: Items deleted from the “Deleted Items” folder. Retained for 14 or 30 days (based on RetainDeletedItemsFor).
• Purges: Items deleted from Deletions or hard-deleted via Shift+Delete. Cleared by the Managed Folder Assistant unless Litigation Hold is enabled.
• DiscoveryHolds: If Litigation Hold, eDiscovery Hold, or Retention Policy is active, purged items are moved here and cannot be deleted by any user or administrator.
• Versions: Retains historical versions of calendar items and contacts if modified by an attacker.

# Check Recoverable Items folder sizes and hold status
Get-Mailbox "victim@contoso.com" | Select-Object DisplayName, RetainDeletedItemsFor, LitigationHoldEnabled, SingleItemRecoveryEnabled

# Inspect item counts across hidden recovery folders
Get-MailboxFolderStatistics "victim@contoso.com" -FolderScope RecoverableItems | Select-Object Name, ItemsInFolder, FolderSize

---

4. Message Trace Triangular Correlation

As detailed in Fiche 15: Exchange Online Message Trace Forensics, reconciling mailbox state with the Mail Transfer Agent (MTA) log stream provides definitive proof of message dispatch and delivery.

sequenceDiagram
    autonumber
    actor Attacker as Threat Actor (Compromised Session)
    participant EXO as Exchange Mailbox (Store)
    participant MTA as Exchange Transport Service (MTA)
    participant ExtTarget as External Wire Fraud Target
    participant UAL as Purview Unified Audit Log

    Attacker->>EXO: Send phishing email with fraudulent invoice
    EXO->>UAL: Log 'Send' / 'SendAs' event with ClientIP & SessionID
    EXO->>MTA: Submit message to Transport Pipeline
    MTA->>MTA: Evaluate Transport Rules & Outbound Anti-Spam
    MTA->>ExtTarget: Deliver message over SMTP (TLS handshake)
    MTA->>UAL: Message Trace logs 'DELIVER' event with MessageID
    Attacker->>EXO: Move sent message to Deleted Items & HardDelete
    Note over EXO: Message removed from visible mailbox, preserved in Purges/Holds
    Note over UAL: MTA Message Trace record proves message was transmitted!

---

5. Detection Engineering: Exchange Hunting Queries

KQL: MailItemsAccessed Throttling Detection

// Detect bulk sync operations where throttling obscured specific item reads
CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType == "MailItemsAccessed"
| extend OpProps = RawEventData.OperationProperties
| extend IsThrottled = tostring(OpProps.IsThrottled)
| extend Folders = RawEventData.Folders
| where IsThrottled =~ "True"
| project TimeGenerated, AccountDisplayName, IPAddress, IsThrottled, Folders, RawEventData
| sort by TimeGenerated desc

KQL: Attacker Mailbox Cleanup (Bulk Deletions)

// Detect rapid deletion of messages following compromised sign-ins
CloudAppEvents
| where TimeGenerated >= ago(7d)
| where ActionType in ("MoveToDeletedItems", "SoftDelete", "HardDelete")
| summarize
    DeletedCount = count(),
    AffectedFolders = make_set(tostring(RawEventData.FolderPathName)),
    Clients = make_set(tostring(RawEventData.ClientInfoString))
    by AccountDisplayName, IPAddress, bin(TimeGenerated, 15m)
| where DeletedCount > 20
| sort by DeletedCount desc

PowerShell: Targeted EDiscovery Extraction

<#
.SYNOPSIS
    Searches the Recoverable Items partition for messages purged during a breach window.
#>
Connect-IPPSSession

$SearchName = "IR_PurgedMessages_$(Get-Date -Format 'yyyyMMdd')"
$Query = "(Received >= '2026-09-01' AND Received <= '2026-09-17') AND (subject:'invoice' OR subject:'wire' OR subject:'payment')"

New-ComplianceSearch -Name $SearchName -ExchangeLocation "victim@contoso.com" -ContentMatchQuery $Query
Start-ComplianceSearch -Name $SearchName

# Monitor progress
Get-ComplianceSearch -Name $SearchName

---

6. Incident Response Playbook: Step-by-Step Triage

1. Preserve Volatile Mailbox State Immediately: Place the compromised mailbox on Litigation Hold to prevent Managed Folder Assistant purges:

   Set-Mailbox "victim@contoso.com" -LitigationHoldEnabled $true -RetentionComment "Active IR Hold"

2. Audit Active Inbox and Transport Rules: Dump all mailbox forwarding rules, hidden rules, and transport rules:

   Get-InboxRule -Mailbox "victim@contoso.com" | Select-Object Name, Description, ForwardTo, MoveToFolder

   (Refer to Fiche 27: Mailbox Rules as Persistence and Fiche 28: Mail Forwarding Persistence).

3. Audit Non-Owner Mailbox Access: Extract all non-owner actions (Delegate, Admin, External logon types):

   Search-UnifiedAuditLog -Operations "MailItemsAccessed", "SendAs", "SendOnBehalf" -FreeText "victim@contoso.com" -StartDate (Get-Date).AddDays(-14) -EndDate (Get-Date)

4. Reconstruct Outbound Dispatch History: Query Message Trace for all outbound messages dispatched during the unauthorized session:

   Get-MessageTrace -SenderAddress "victim@contoso.com" -StartDate (Get-Date).AddDays(-10) -EndDate (Get-Date)

---

7. Related Intelligence & Cross-References

15. Exchange Online Message Trace Forensics Analyze transport agent events, delivery status codes, and outbound routing.

17. Mailbox Auditing & MailItemsAccessed Understand the underlying engineering of MailItemsAccessed audit throttling.

27. Mailbox Rules as Persistence Hunt for hidden and corrupted MAPI rules used to suppress security alerts.

37. Data Access Paths & Blast Radius Synthesize Exchange evidence into a defensible regulatory blast radius report.