detecting-email-account-compromise

by mukul975

detecting-email-account-compromise helps incident responders and SOC analysts investigate Microsoft 365 and Google Workspace mailbox takeover by checking suspicious sign-ins, inbox rule abuse, external forwarding, OAuth grants, and Graph/audit-log activity. Use it as a practical detecting-email-account-compromise guide for fast triage.

Stars0

Favorites0

Comments0

AddedMay 9, 2026

CategoryIncident Response

Install Command

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-email-account-compromise

Curation Score

This skill scores 78/100 because it has a credible, real incident-response workflow for detecting email account compromise and enough supporting artifacts for users to judge fit. Directory users should see it as a solid install candidate for Microsoft 365/Google Workspace compromise investigations, with some caveats around workflow completeness and onboarding clarity.

78/100

Strengths

SKILL.md clearly states the trigger and use case: detect compromised O365 and Google Workspace accounts by analyzing inbox rules, suspicious sign-ins, forwarding rules, and API access patterns.
The repository includes practical support material: an API reference for Microsoft Graph endpoints and a Python script that analyzes inbox rules, sign-in logs, and OAuth grants.
Frontmatter is valid and rich in operational tags and MITRE mapping, which helps agents and users understand scope quickly.

Cautions

No install command or quick-start guidance is provided, so users must infer setup and execution steps from the script and reference docs.
The workflow appears Microsoft-Graph-centric despite mentioning Google Workspace in the description, which may limit clarity for non-Microsoft environments.

Microsoft Graph Office365 Gmail Email Security Audit Logs Sign In Analysis Inbox Rules

Overview

Overview of detecting-email-account-compromise skill

The detecting-email-account-compromise skill helps you investigate mailbox takeover in Microsoft 365 and Google Workspace by looking for the signals that matter most: suspicious sign-ins, inbox rule abuse, external forwarding, and unusual API or OAuth access. It is best for incident responders, SOC analysts, and email admins who need a fast, evidence-driven way to decide whether an account is merely noisy or truly compromised.

What this detecting-email-account-compromise skill does

This detecting-email-account-compromise skill focuses on triage and detection, not generic email security advice. It aligns with incident response workflows where you need to connect mailbox behavior to identity events and persistence mechanisms, especially for BEC-style intrusions.

Best-fit use cases

Use it when you have alerts about strange forwarding rules, deleted messages, unusual login locations, or suspicious Graph activity. It is also useful when you need a repeatable detecting-email-account-compromise guide for validating whether a mailbox has been used for exfiltration or lateral phishing.

What makes it useful in IR

The practical value is correlation: inbox rule changes, sign-in anomalies, and OAuth grants often tell a clearer story together than in isolation. For detecting-email-account-compromise for Incident Response, that means faster scoping, better evidence collection, and fewer false positives from one-off login noise.

How to Use detecting-email-account-compromise skill

Install the skill in your workspace

Use the repository install flow for this detecting-email-account-compromise install:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-email-account-compromise

After install, confirm the skill folder is available under skills/detecting-email-account-compromise and that your agent can read both the skill file and its support material.

Read these files first

Start with SKILL.md to understand the intended workflow, then open references/api-reference.md for the Microsoft Graph endpoints and indicator table. Read scripts/agent.py next if you want the detection logic, rule patterns, and input expectations; it shows what the skill is actually looking for.

Turn a vague request into a usable prompt

The skill works best when you give it a concrete incident frame, not just “check this mailbox.” Include platform, time window, suspected user, and the artifact types you already have. A strong detecting-email-account-compromise usage prompt looks like:

“Investigate suspected account takeover for user jane@company.com in Microsoft 365 over the last 7 days. Focus on inbox rules, external forwarding, impossible-travel sign-ins, and OAuth consent grants. Summarize compromise likelihood, key evidence, and next actions for containment.”

Input quality that changes output

Provide the exact tenant type, mailbox owner, time range, and any known bad indicators such as external domains, suspicious user agents, or a specific message rule name. If you already collected Graph or audit-log exports, include them; the skill can then prioritize correlation instead of guessing what to query first.

detecting-email-account-compromise skill FAQ

Is this only for Microsoft 365?

No. The repository is strongest for Microsoft 365, but the detecting-email-account-compromise skill also covers Google Workspace concepts at a workflow level. If your environment is mixed, use it to structure the investigation and then adapt the data source details to your platform.

When should I not use this skill?

Do not use it as a full email security program or as a generic phishing response prompt. If you only need a one-line opinion about a suspicious message, this skill is more detailed than necessary; it is designed for account compromise investigation and evidence-based triage.

Does it replace a manual hunt query?

No. It helps you decide what to check and how to interpret it, but you still need tenant access, log data, and validation. The detecting-email-account-compromise guide is most valuable when you already have identity and audit logs to inspect or export.

Is it suitable for beginners?

Yes, if the user is willing to provide context. Beginners get the best results when they ask for a checklist-style investigation plan and share the mailbox, date range, and suspected behavior rather than expecting the skill to infer everything automatically.

How to Improve detecting-email-account-compromise skill

Give the skill the artifacts it can reason over

The fastest way to improve results is to provide mailbox rules, sign-in events, OAuth grants, and relevant timestamps in one prompt. The more complete the incident bundle, the less the model has to invent around gaps, which matters a lot for detecting-email-account-compromise usage.

Be explicit about what “compromise” means in your case

Tell the skill whether you care most about exfiltration, persistence, BEC risk, or unauthorized access. That changes the emphasis of the analysis: forwarding rules matter more for exfiltration, while risky sign-ins and token grants matter more for takeover and persistence.

Watch for common failure modes

The most common misses are overly broad time windows, missing tenant context, and logs pasted without user identity. Another failure mode is asking for “all suspicious activity” without saying what signal should count as suspicious; the output gets better when you name the exact indicators you want checked.

Iterate with a tighter second pass

If the first result is too broad, refine it with the evidence that was already found. For example: “Re-review only the forwarding rule and the two sign-ins from new countries, and explain which one is most consistent with compromise.” That kind of follow-up usually produces a better detecting-email-account-compromise skill outcome than starting over from scratch.

Ratings & Reviews

No ratings yet

Share your review

0/10000

Latest reviews

Saving...

more skill

conducting-malware-incident-response

by mukul975

conducting-malware-incident-response helps IR teams triage suspected malware, confirm infections, scope spread, contain endpoints, and support eradication and recovery. It is designed for conducting-malware-incident-response for Incident Response workflows with evidence-backed steps, telemetry-driven decisions, and practical containment guidance.

Incident Response

Favorites 0GitHub 0

detecting-s3-data-exfiltration-attempts

by mukul975

detecting-s3-data-exfiltration-attempts helps investigate possible AWS S3 data theft by correlating CloudTrail S3 data events, GuardDuty findings, Amazon Macie alerts, and S3 access patterns. Use this detecting-s3-data-exfiltration-attempts skill for Security Audit, incident response, and suspicious bulk-download analysis.

Security Audit

Favorites 0GitHub 6.2k

analyzing-usb-device-connection-history

by mukul975

analyzing-usb-device-connection-history helps investigate USB device connection history on Windows using registry hives, event logs, and setupapi.dev.log for Digital Forensics, insider threat work, and incident response. It supports timeline reconstruction, device correlation, and removable-media evidence analysis.

Digital Forensics

Favorites 0GitHub 6.2k

analyzing-bootkit-and-rootkit-samples

by mukul975

analyzing-bootkit-and-rootkit-samples is a malware analysis skill for MBR, VBR, UEFI, and rootkit investigations. Use it to inspect boot sectors, firmware modules, and anti-rootkit indicators when compromise persists below the OS layer. It is suited for analysts who need a practical guide, clear workflow, and evidence-based triage for Malware Analysis.

Malware Analysis

Favorites 0GitHub 6.2k

extracting-browser-history-artifacts

by mukul975

extracting-browser-history-artifacts is a Digital Forensics skill for extracting browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge. Use it to turn browser profile files into timeline-ready evidence with repeatable, case-focused workflow guidance.

Digital Forensics

Favorites 0GitHub 0

detecting-ransomware-encryption-behavior

by mukul975

detecting-ransomware-encryption-behavior helps defenders spot ransomware-style encryption using entropy analysis, file I/O monitoring, and behavioral heuristics. It is suited for incident response, SOC tuning, and red-team validation when you need to detect mass file changes, rename bursts, and suspicious process activity quickly.

Incident Response

Favorites 0GitHub 0

detecting-privilege-escalation-attempts

by mukul975

detecting-privilege-escalation-attempts helps hunt privilege escalation on Windows and Linux, including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse. Built for threat hunting teams that need a practical workflow, reference queries, and helper scripts.

Threat Hunting

Favorites 0GitHub 0

detecting-evasion-techniques-in-endpoint-logs

by mukul975

The detecting-evasion-techniques-in-endpoint-logs skill helps hunt defense evasion in Windows endpoint logs, including log clearing, timestomping, process injection, and security tool disabling. Use it for threat hunting, detection engineering, and incident triage with Sysmon, Windows Security, or EDR telemetry.

Threat Hunting

Favorites 0GitHub 0

analyzing-network-traffic-for-incidents

by mukul975

analyzing-network-traffic-for-incidents helps incident responders analyze PCAPs, flow logs, and packet captures to confirm C2, lateral movement, exfiltration, and exploitation attempts. Built for analyzing-network-traffic-for-incidents for Incident Response with Wireshark, Zeek, and NetFlow-style investigation.

Incident Response

Favorites 0GitHub 0

detecting-credential-dumping-techniques

by mukul975

The detecting-credential-dumping-techniques skill helps you detect LSASS access, SAM export, NTDS.dit theft, and comsvcs.dll MiniDump abuse using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules. It is built for threat hunting, detection engineering, and Security Audit workflows.

Security Audit

Favorites 0GitHub 0

correlating-security-events-in-qradar

by mukul975

correlating-security-events-in-qradar helps SOC and detection teams correlate IBM QRadar offenses with AQL, offense context, custom rules, and reference data. Use this guide to investigate incidents, reduce false positives, and build stronger correlation logic for Incident Response.

Incident Response

Favorites 0GitHub 0

containing-active-breach

by mukul975

containing-active-breach is an incident-response skill for live breach containment. It helps isolate hosts, block suspicious traffic, disable compromised accounts, and slow lateral movement using a structured containing-active-breach guide with practical API and script references.

Incident Response

Favorites 0GitHub 0

configuring-suricata-for-network-monitoring

by mukul975

The configuring-suricata-for-network-monitoring skill helps deploy and tune Suricata for IDS/IPS monitoring, EVE JSON logging, rules management, and SIEM-ready output. It suits the configuring-suricata-for-network-monitoring for Security Audit workflow when you need practical setup, validation, and false-positive reduction.

Security Audit

Favorites 0GitHub 0

detecting-process-injection-techniques

by mukul975

detecting-process-injection-techniques helps analyze suspicious in-memory activity, validate EDR alerts, and identify process hollowing, APC injection, thread hijacking, reflective loading, and classic DLL injection for Security Audit and malware triage.

Security Audit

Favorites 0GitHub 0

detecting-business-email-compromise

by mukul975

The detecting-business-email-compromise skill helps analysts, SOC teams, and incident responders identify BEC attempts using email-header checks, social-engineering clues, detection logic, and response-oriented workflows. Use it as a practical detecting-business-email-compromise guide for triage, validation, and containment.

Incident Response

Favorites 0GitHub 6.1k

detecting-email-forwarding-rules-attack

by mukul975

The detecting-email-forwarding-rules-attack skill helps Security Audit, threat hunting, and incident response teams find malicious mailbox forwarding rules used for persistence and email collection. It guides analysts through Microsoft 365 and Exchange evidence, suspicious rule patterns, and practical triage for forwarding, redirect, delete, and hide behaviors.

Security Audit

Favorites 0GitHub 0