New Inbox Rule Creation | LogForge Templates Registry

exchange email security audit microsoft365 bec-indicator

📄 JSON Format

📊 22 Fields

✨ Generator

⏱️ Low Frequency

Overview

Records the creation of new inbox rules in Exchange Online mailboxes. Critical for detecting Business Email Compromise (BEC) attacks and malicious email forwarding.

When Generated:

When users create new inbox rules via Outlook Web App
When inbox rules are created programmatically
During email forwarding setup attempts
When automated email processing rules are established

Security Relevance: High

Compliance: SOC 2 GDPR HIPAA PCI DSS NIST Cybersecurity Framework

Frequency Notes: Low frequency during normal business operations, with spikes during onboarding and organizational changes. Suspicious patterns include off-hours creation and rules targeting financial keywords.

Resources

Documentation

Exchange Online Auditing Documentation official
Microsoft 365 Unified Audit Log official
Exchange Online Management Shell official

Tools

Microsoft 365 Compliance Center - Web-based interface for searching and analyzing audit logs
Exchange Online PowerShell - PowerShell module for Exchange Online management and auditing
Microsoft Graph Security API - Programmatic access to Microsoft 365 security data including audit logs

Generation Configuration

Base Frequency: 5 events/hour

Time Patterns: business_hours night_hours weekend

Business Hours Multiplier: 3.0x

Night Hours Multiplier: 0.2x

Weekend Multiplier: 0.1x

Details

new_inbox_rule

Event Type

Fields

Low

Frequency

Field Definitions

Complete field reference for this event type with data types, descriptions, and example values.

Field Name	Type	Required	Format	Description	Example Value	Possible Values
AppAccessContext Source: Multiple GUIDs and session tokens	Object	Required	—	Azure AD authentication context for the application access	`{"AADSessionId": "uuid", "IssuedAtTime": "timestamp", "UniqueTokenId": "token"}`	—
AppId Source: Fixed Exchange Online application identifier	String	Required	—	Application ID for Exchange Online Web Services	`00000002-0000-0ff1-ce00-000000000000`	—
AppPoolName Source: Fixed Exchange Online app pool identifier	String	Required	—	IIS application pool name hosting the Exchange service	`MSExchangeOWAAppPool`	—
ClientIP Source: random_public_ip() + random_port()	String	Required	`IPv4:Port`	Client IP address and port that initiated the rule creation	`203.0.113.42:54321`	—
CreationTime Source: current_timestamp()	DateTime	Required	`ISO 8601`	UTC timestamp when the audit record was created	`2024-01-15T14:30:25Z`	—
ExternalAccess Source: Random boolean with 30% true probability	Boolean	Required	—	Indicates if the access originated from outside the organization	`false`	—
Id Source: random_guid()	String	Required	`UUID`	Unique identifier for this audit record	`a1b2c3d4-e5f6-7890-abcd-ef1234567890`	—
ObjectId Source: Constructed from server, domain, user, and rule name	String	Required	—	Full path to the Exchange object (mailbox and rule name)	`SERVER.PROD.OUTLOOK.COM/Organizations/contoso.com/User, John Doe\MyRule`	—
Operation Source: Fixed value for this template	String	Required	—	The Exchange operation that was performed	`New-InboxRule`	—
OrganizationId Source: random_guid()	String	Required	`UUID`	Unique identifier for the Microsoft 365 organization	`12345678-abcd-ef12-3456-789abcdef012`	—
OrganizationName Source: registry.get_organization_field('domain')	String	Required	—	Domain name of the Microsoft 365 organization	`contoso.com`	—
OriginatingServer Source: Random server name and version numbers	String	Required	—	Exchange server that processed the request with version info	`SN6PR08MB1234 (15.20.8245.123)`	—
Parameters Source: Array of common inbox rule parameters with random values	Array	Required	—	Array of parameter objects containing rule configuration	`[{"Name": "MoveToFolder", "Value": "Archive"}]`	—
RecordType Source: Fixed value 1 for Exchange operations	Integer	Required	—	Microsoft 365 audit record type (1 = Exchange Admin)	`1`	—
RequestId Source: random_guid()	String	Required	`UUID`	Unique identifier for the original request	`a1b2c3d4-e5f6-7890-abcd-ef1234567890`	—
ResultStatus Source: Fixed value 'True' for successful operations	String	Required	—	Success status of the operation	`True`	`True` - Operation completed successfully `False` - Operation failed
SessionId Source: random_guid()	String	Required	`UUID`	Session identifier for the user's Exchange session	`a1b2c3d4-e5f6-7890-abcd-ef1234567890`	—
UserId Source: registry.get_random_user().username + '@' + domain	String	Required	`Email`	Email address of the user who created the rule	`john.doe@contoso.com`	—
UserKey Source: Same as UserId	String	Required	`Email`	User identifier key (typically same as UserId)	`john.doe@contoso.com`	—
UserType Source: Random integer 0-4	Integer	Required	—	Type classification of the user account	`2`	`0` - Regular user `1` - Reserved `2` - Admin user `3` - DcAdmin user `4` - System user
Version Source: Fixed value 1	Integer	Required	—	Schema version for the audit record format	`1`	—
Workload Source: Fixed value 'Exchange'	String	Required	—	Microsoft 365 service that generated the audit record	`Exchange`	—