After the events of the last weeks around the latest zero day vulnerabilities in Exchange and once you've finished cleaning up any back doors that may have been left on servers its a good idea to review some other less known but established ways bad actors may hide persistent access within Mailboxes. One of these are Inbox Rules (but Mail Flow rules could also be used) and a more advanced method is the hidden Inbox rule exploit that was first talked about https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/ and I covered it in https://gsexdev.blogspot.com/2019/05/audting-inbox-rules-with-ews-and-graph.html and somebody else https://mgreen27.github.io/posts/2019/06/09/O365HiddenRules.html there are a number of tools and techniques around detecting these types of rule but are all focused more toward Office365 as that was where at the time this exploit was being mostly employed. In my post at the time I mo...
Pushing the Envelope in Messaging and Office 365 Development