function Get-ExtendedProperty

{

Param

(

# Param1 help description

[Parameter(Mandatory=$true,

ValueFromPipelineByPropertyName=$true,

Position=0)]

[ValidateNotNullOrEmpty()]

[Microsoft.Exchange.WebServices.Data.Item]

$Item,

# Param2 help descriptio

[ValidateNotNullOrEmpty()]

[Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition]

$Property

)

$Value = $null

$Succeeded = $Item.TryGetProperty($Property, [ref]$Value)

if($Succeeded)

{

$Value

}

else

{

Write-Warning ("Could not get value for " + [System.Convert]::ToString($Property.Tag,16))

}

}

function Check-Action($bytearray, [REF] $isPotentiallyMalicious, [REF] $actionType, [REF] $actionCommand)

{

$isPotentiallyMalicious.Value = $false

$actionType.Value = ""

$actionCommand.Value = ""

if ($bytearray.Length -gt 30 )

{

if ($bytearray[2] -eq 1 -and $bytearray[14] -eq 5 )

{

if ($bytearray[29] -eq 0x14)

{

$actionType.Value = "ID_ACTION_CUSTOM"

$isPotentiallyMalicious.Value = $true

}

elseif ($bytearray[29] -eq 0x1e)

{

$actionType.Value = "ID_ACTION_EXECUTE"

$isPotentiallyMalicious.Value = $true

}

elseif ($bytearray[29] -eq 0x20)

{

$actionType.Value = "ID_ACTION_RUN_MACRO"

$isPotentiallyMalicious.Value = $true

}

}

if ($isPotentiallyMalicious.Value -eq $true)

{

foreach ($byte in $bytearray)

{

if ($byte -gt 31 -and $byte -lt 127)

{

$returnstring += [char]$byte

}

}

$actionCommand.Value = $returnstring

}

}

}

function Convert-ByteArrays ($bytearray)

{

return [Convert]::ToBase64String($bytearray)

}

$EncodedCompressedFile = @'

$DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress)

$UncompressedFileBytes = New-Object Byte[](1092608)

$DeflatedStream.Read($UncompressedFileBytes, 0, 1092608) | Out-Null

$asm = [Reflection.Assembly]::Load($UncompressedFileBytes)

[string]$hostName = "outlook.office365.com"

$adminCredential = Get-Credential

$ImpersonationAccount = $adminCredential.UserName

$UserName = $adminCredential.UserName

$password = $adminCredential.GetNetworkCredential().Password

$exchService = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService

$exchService.Credentials = new-object System.Net.NetworkCredential($UserName, $password, "")

$exchService.HttpHeaders.Add("X-AnchorMailbox", $UserName)

$exchService.Url = new-object System.Uri(("https://" + $hostName + "/EWS/Exchange.asmx"))

$searchFilterCollection = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+SearchFilterCollection([Microsoft.Exchange.WebServices.Data.LogicalOperator]::Or)

$searchFilter1 = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+ContainsSubstring([Microsoft.Exchange.WebServices.Data.ContactSchema]::ItemClass,"IPM.Rule.Version2.Message")

$searchFilter2 = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+ContainsSubstring([Microsoft.Exchange.WebServices.Data.ContactSchema]::ItemClass,"IPM.Microsoft.FolderDesign.FormsDescription")

$searchFilterCollection.add($searchFilter1)

$searchFilterCollection.add($searchFilter2)

$PidTagRuleMessageName = New-Object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x65EC, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String) # Rule name

$PidTagExtendedRuleMessageActions = new-object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x0E99, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::Binary) # Binary blob that defines actions. Also the condition for "Start Application" rules

$PidTagExtendedRuleMessageCondition = new-object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x0E9A, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::Binary) #

$PidTagRuleMessageState = New-Object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x65E9, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::Integer) # Defines whether rule is enabled

$PidTagOfflineAddressBookName = New-Object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x6800, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String) # Form name

$dateTimeCreatedProperty = [Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeCreated

$PropertySet = new-object Microsoft.Exchange.WebServices.Data.PropertySet

$PropertySet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::ItemClass)

$PropertySet.Add($PidTagRuleMessageName)

$PropertySet.Add($PidTagExtendedRuleMessageActions)

$PropertySet.Add($PidTagExtendedRuleMessageCondition)

$PropertySet.Add($PidTagRuleMessageState)

$PropertySet.Add($PidTagOfflineAddressBookName)

$propertySet.Add($dateTimeCreatedProperty)

$connectionUri = "https://outlook.office365.com/powershell-liveid?email=" + $adminCredential.UserName

$ExoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $connectionUri -Credential $adminCredential -Authentication Basic -AllowRedirection

Import-PSSession $ExoSession

$mailBoxes = Get-Mailbox | Select UserPrincipalName

("Number of mailboxes to process: " + $mailBoxes.Count.ToString())

$Rules = @()

$Forms = @()

foreach ($box in $mailBoxes)

{

Write-Host "Pulling Inbox rules and forms for: " $box.UserPrincipalName;

$exchService.ImpersonatedUserId = New-Object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,$box.UserPrincipalName);

$exchService.HttpHeaders.Remove("X-AnchorMailbox")

$exchService.HttpHeaders.("X-AnchorMailbox", $box.UserPrincipalName)

$itemView = New-Object Microsoft.Exchange.WebServices.Data.ItemView(100,0,[Microsoft.Exchange.WebServices.Data.OffsetBasePoint]::Beginning)

$itemView.Traversal = [Microsoft.Exchange.WebServices.Data.ItemTraversal]::Shallow

$itemView.OrderBy.add([Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeReceived,[Microsoft.Exchange.WebServices.Data.SortDirection]::Ascending)

$itemView.PropertySet = $PropertySet

$itemView.Traversal = [Microsoft.Exchange.WebServices.Data.ItemTraversal]::Associated

$rfRootFolderID = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox, $box.UserPrincipalName)

$rfRootFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($exchService,$rfRootFolderID)

# Do the search

$FindResults = $exchService.FindItems([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox, $searchFilterCollection, $itemView)

foreach($Item in $FindResults.Items)

{

$ruleactionsbytearray = Get-ExtendedProperty -Item $Item -Property $PidTagExtendedRuleMessageActions

$ruleconditionsbytearray = Get-ExtendedProperty -Item $Item -Property $PidTagExtendedRuleMessageCondition

$readableactions = Convert-ByteArrays ($ruleactionsbytearray)

$readableconditions = Convert-ByteArrays($ruleconditionsbytearray)

$isPotentiallyMalicious = $false

$actionType = ""

$actionCommand = ""

Check-Action ($ruleactionsbytearray) ([REF] $isPotentiallyMalicious) ([REF] $actionType) ([REF] $actionCommand)

if ($Item.ItemClass -eq "IPM.Rule.Version2.Message")

{

$Rules += New-Object PSObject -Property @{

User = $box.UserPrincipalName

RuleName = Get-ExtendedProperty -Item $Item -Property $PidTagRuleMessageName

IsPotentiallyMalicious = $isPotentiallyMalicious

ActionType = $actionType

ActionCommand = $actionCommand

Action = $readableactions

Condition = $readableconditions

State = Get-ExtendedProperty -Item $Item -Property $PidTagRuleMessageState

DateCreated = $Item.DateTimeCreated

ItemClass = $Item.ItemClass

}

}

if ($Item.ItemClass -eq "IPM.Microsoft.FolderDesign.FormsDescription")

{

$Forms += New-Object PSObject -Property @{

User = $box.UserPrincipalName

FormName = Get-ExtendedProperty -Item $Item -Property $PidTagOfflineAddressBookName

DateCreated = $Item.DateTimeCreated

ItemClass = $Item.ItemClass

}

}

}

}

$Rules | Export-Csv -Path (".\MailboxRulesExport-" + (Get-Date).ToString('yyyy-MM-dd') + ".csv")

$Forms | Export-Csv -Path (".\MailboxFormsExport-" + (Get-Date).ToString('yyyy-MM-dd') + ".csv")

Write-Output "[*] These are the rules we found."

Write-Output "[*] These are the forms we found."