diff --git a/Hawk/Hawk.psd1 b/Hawk/Hawk.psd1 index 95df803..809a1e7 100644 --- a/Hawk/Hawk.psd1 +++ b/Hawk/Hawk.psd1 @@ -87,7 +87,10 @@ 'Get-HawkUserEntraIDSignInLog', 'Get-HawkTenantEntraIDAuditLog', 'Get-HawkTenantRiskyUsers', - 'Get-HawkTenantRiskDetections' + 'Get-HawkTenantRiskDetections', + 'Get-HawkUserUALInboxRuleCreation', + 'Get-HawkUserUALInboxRuleModification', + 'Get-HawkUserUALInboxRuleRemoval' # Cmdlets to export from this module # CmdletsToExport = '' diff --git a/Hawk/changelog.md b/Hawk/changelog.md index 6632fe8..0bf4767 100644 --- a/Hawk/changelog.md +++ b/Hawk/changelog.md @@ -108,3 +108,9 @@ - Added log pull of user SharePoint Search activity to the User Investigation (Get-HawkUserSharePointSearchQuery) - Added telemetry discloser on Readme and updated license - Added AppInsight GUID + +## 4.1 (2025-3-xx) + +- Added Get-HawkUserUALInboxRuleCreation: Analyzes audit logs for inbox rules created by specific users +- Added Get-HawkUserUALInboxRuleModification: Analyzes audit logs for inbox rules modified by specific users +- Added Get-HawkUserUALInboxRuleRemoval: Analyzes audit logs for inbox rules removed by specific users diff --git a/Hawk/functions/User/Get-HawkUserUALInboxRuleCreation.ps1 b/Hawk/functions/User/Get-HawkUserUALInboxRuleCreation.ps1 new file mode 100644 index 0000000..2f55bb9 --- /dev/null +++ b/Hawk/functions/User/Get-HawkUserUALInboxRuleCreation.ps1 @@ -0,0 +1,117 @@ +Function Get-HawkUserUALInboxRuleCreation { + <# + .SYNOPSIS + Retrieves audit log entries for inbox rules that were historically created by or for a specific user. + + .DESCRIPTION + This function queries the Microsoft 365 Unified Audit Log for inbox rule creation events + (New-InboxRule) associated with a specific user or set of users. It focuses on historical + record-keeping and identifying potentially suspicious rules that were created. + + Key points: + - Displays creation events for inbox rules, including who created them and when. + - Flags created rules that appear suspicious (e.g., rules that forward externally, delete + messages, or filter based on suspicious keywords). + - Does not confirm whether the rules are currently active or still exist. + + For current, active rules, use Get-HawkUserInboxRule instead. + + This function is the user-specific counterpart to Get-HawkTenantAdminInboxRuleCreation. + + .PARAMETER UserPrincipalName + Single UPN of a user, comma-separated list of UPNs, or array of objects that contain UPNs. + This parameter specifies which users' inbox rule creation events to investigate. + + .OUTPUTS + File: Simple_User_Inbox_Rules_Creation_.csv/.json + Path: \ + Description: Simplified view of created inbox rule events for the user. + + File: User_Inbox_Rules_Creation_.csv/.json + Path: \ + Description: Detailed audit log data for created inbox rules for the user. + + File: _Investigate_User_Inbox_Rules_Creation_.csv/.json + Path: \ + Description: A subset of historically created rules flagged as suspicious. + + .EXAMPLE + Get-HawkUserUALInboxRuleCreation -UserPrincipalName user@contoso.com + + Retrieves inbox rule creation events from the audit logs for user@contoso.com. + + .EXAMPLE + Get-HawkUserUALInboxRuleCreation -UserPrincipalName (Get-Mailbox -Filter {CustomAttribute1 -eq "C-level"}) + + Retrieves inbox rule creation events for all users with CustomAttribute1 set to "C-level". + + .LINK + Get-HawkTenantAdminInboxRuleCreation + Get-HawkUserInboxRule + #> + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [array]$UserPrincipalName + ) + + # Check if Hawk object exists and is fully initialized + if (Test-HawkGlobalObject) { + Initialize-HawkGlobalObject + } + + Test-EXOConnection + Send-AIEvent -Event "CmdRun" + + # Verify our UPN input + [array]$UserArray = Test-UserObject -ToTest $UserPrincipalName + + foreach ($Object in $UserArray) { + [string]$User = $Object.UserPrincipalName + + Out-LogFile "Initiating collection of inbox rule creation events for $User from the UAL." -Action + + try { + # Build search command for unified audit log - specific to this user + $searchCommand = "Search-UnifiedAuditLog -RecordType ExchangeAdmin -Operations 'New-InboxRule' -UserIds $User" + [array]$NewInboxRules = Get-AllUnifiedAuditLogEntry -UnifiedSearch $searchCommand + + if ($NewInboxRules.Count -gt 0) { + Out-LogFile ("Found " + $NewInboxRules.Count + " inbox rule creation events for $User in the audit logs.") -Information + + # Process and output the results + $ParsedRules = $NewInboxRules | Get-SimpleUnifiedAuditLog + + if ($ParsedRules) { + Out-LogFile "Writing parsed inbox rule creation data." -Action + $ParsedRules | Out-MultipleFileType -FilePrefix "Simple_User_Inbox_Rules_Creation" -csv -json -User $User + $NewInboxRules | Out-MultipleFileType -FilePrefix "User_Inbox_Rules_Creation" -csv -json -User $User + + # Check for suspicious rules using the helper function + $SuspiciousRules = $ParsedRules | Where-Object { + $reasons = @() + Test-SuspiciousInboxRule -Rule $_ -Reasons ([ref]$reasons) + } + + if ($SuspiciousRules) { + Out-LogFile "Found $($SuspiciousRules.Count) suspicious inbox rule creation events for $User." -Notice + Out-LogFile "Please verify this activity is legitimate." -Notice + $SuspiciousRules | Out-MultipleFileType -FilePrefix "_Investigate_User_Inbox_Rules_Creation" -csv -json -User $User -Notice + } + } + else { + Out-LogFile "Error: Failed to parse inbox rule audit data for $User." -isError + } + } + else { + Out-LogFile "No inbox rule creation events found in audit logs for $User." -Information + } + } + catch { + Out-LogFile "Error analyzing inbox rule creation for $User : $_" -isError + Write-Error -ErrorRecord $_ -ErrorAction Continue + } + + Out-LogFile "Completed collection of inbox rule creation events for $User from the UAL." -Information + } +} \ No newline at end of file diff --git a/Hawk/functions/User/Get-HawkUserUALInboxRuleModification.ps1 b/Hawk/functions/User/Get-HawkUserUALInboxRuleModification.ps1 new file mode 100644 index 0000000..ffa6040 --- /dev/null +++ b/Hawk/functions/User/Get-HawkUserUALInboxRuleModification.ps1 @@ -0,0 +1,120 @@ +Function Get-HawkUserUALInboxRuleModification { + <# + .SYNOPSIS + Retrieves audit log entries for inbox rules that were historically modified by or for a specific user. + + .DESCRIPTION + This function queries the Microsoft 365 Unified Audit Log for inbox rule modification events + (Set-InboxRule) associated with a specific user or set of users. It focuses on historical + changes to existing rules, helping identify suspicious modifications (e.g., forwarding to + external addresses, enabling deletion, or targeting sensitive keywords). + + The logged events do not indicate how or where the modification took place, only that + an inbox rule was changed at a given time by a specific account. + + Key points: + - Shows modification events for inbox rules, including who modified them and when. + - Flags modifications that may be suspicious based on predefined criteria. + - Does not indicate whether the rules are currently active or still exist. + + For current, active rules, use Get-HawkUserInboxRule instead. + + This function is the user-specific counterpart to Get-HawkTenantAdminInboxRuleModification. + + .PARAMETER UserPrincipalName + Single UPN of a user, comma-separated list of UPNs, or array of objects that contain UPNs. + This parameter specifies which users' inbox rule modification events to investigate. + + .OUTPUTS + File: Simple_User_Inbox_Rules_Modification_.csv/.json + Path: \ + Description: Simplified view of inbox rule modification events for the user. + + File: User_Inbox_Rules_Modification_.csv/.json + Path: \ + Description: Detailed audit log data for modified inbox rules for the user. + + File: _Investigate_User_Inbox_Rules_Modification_.csv/.json + Path: \ + Description: A subset of historically modified rules flagged as suspicious. + + .EXAMPLE + Get-HawkUserUALInboxRuleModification -UserPrincipalName user@contoso.com + + Retrieves inbox rule modification events from the audit logs for user@contoso.com. + + .EXAMPLE + Get-HawkUserUALInboxRuleModification -UserPrincipalName (Get-Mailbox -Filter {CustomAttribute1 -eq "C-level"}) + + Retrieves inbox rule modification events for all users with CustomAttribute1 set to "C-level". + + .LINK + Get-HawkTenantAdminInboxRuleModification + Get-HawkUserInboxRule + #> + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [array]$UserPrincipalName + ) + + # Check if Hawk object exists and is fully initialized + if (Test-HawkGlobalObject) { + Initialize-HawkGlobalObject + } + + Test-EXOConnection + Send-AIEvent -Event "CmdRun" + + # Verify our UPN input + [array]$UserArray = Test-UserObject -ToTest $UserPrincipalName + + foreach ($Object in $UserArray) { + [string]$User = $Object.UserPrincipalName + + Out-LogFile "Initiating collection of inbox rule modification events for $User from the UAL." -Action + + try { + # Build search command for unified audit log - specific to this user + $searchCommand = "Search-UnifiedAuditLog -RecordType ExchangeAdmin -Operations 'Set-InboxRule' -UserIds $User" + [array]$ModifiedInboxRules = Get-AllUnifiedAuditLogEntry -UnifiedSearch $searchCommand + + if ($ModifiedInboxRules.Count -gt 0) { + Out-LogFile ("Found " + $ModifiedInboxRules.Count + " inbox rule modification events for $User in the audit logs.") -Information + + # Process and output the results + $ParsedRules = $ModifiedInboxRules | Get-SimpleUnifiedAuditLog + + if ($ParsedRules) { + Out-LogFile "Writing parsed inbox rule modification data." -Action + $ParsedRules | Out-MultipleFileType -FilePrefix "Simple_User_Inbox_Rules_Modification" -csv -json -User $User + $ModifiedInboxRules | Out-MultipleFileType -FilePrefix "User_Inbox_Rules_Modification" -csv -json -User $User + + # Check for suspicious modifications using the helper function + $SuspiciousModifications = $ParsedRules | Where-Object { + $reasons = @() + Test-SuspiciousInboxRule -Rule $_ -Reasons ([ref]$reasons) + } + + if ($SuspiciousModifications) { + Out-LogFile "Found $($SuspiciousModifications.Count) suspicious inbox rule modification events for $User." -Notice + Out-LogFile "Please verify this activity is legitimate." -Notice + $SuspiciousModifications | Out-MultipleFileType -FilePrefix "_Investigate_User_Inbox_Rules_Modification" -csv -json -User $User -Notice + } + } + else { + Out-LogFile "Error: Failed to parse inbox rule modification audit data for $User." -isError + } + } + else { + Out-LogFile "No inbox rule modification events found in audit logs for $User." -Information + } + } + catch { + Out-LogFile "Error analyzing inbox rule modifications for $User : $_" -isError + Write-Error -ErrorRecord $_ -ErrorAction Continue + } + + Out-LogFile "Completed collection of inbox rule modification events for $User from the UAL." -Information + } +} \ No newline at end of file diff --git a/Hawk/functions/User/Get-HawkUserUALInboxRuleRemoval.ps1 b/Hawk/functions/User/Get-HawkUserUALInboxRuleRemoval.ps1 new file mode 100644 index 0000000..dae0395 --- /dev/null +++ b/Hawk/functions/User/Get-HawkUserUALInboxRuleRemoval.ps1 @@ -0,0 +1,121 @@ +Function Get-HawkUserUALInboxRuleRemoval { + <# + .SYNOPSIS + Retrieves audit log entries for inbox rules that were removed by or for a specific user. + + .DESCRIPTION + This function queries the Microsoft 365 Unified Audit Log for inbox rule removal events + (Remove-InboxRule) associated with a specific user or set of users. It focuses on + historical record-keeping and identifying when inbox rules were removed and by whom. + + The logged events do not indicate the specific method or interface used to remove the rules, + only that a rule was removed at a given time by a specific account. + + Key points: + - Displays removal events for inbox rules, including who removed them and when. + - Flags removals that might be suspicious (e.g., rules that were forwarding externally). + - Provides historical context for rule removals during investigations. + + For current, active rules, use Get-HawkUserInboxRule instead. + + This function is the user-specific counterpart to Get-HawkTenantAdminInboxRuleRemoval. + + .PARAMETER UserPrincipalName + Single UPN of a user, comma-separated list of UPNs, or array of objects that contain UPNs. + This parameter specifies which users' inbox rule removal events to investigate. + + .OUTPUTS + File: Simple_User_Inbox_Rules_Removal_.csv/.json + Path: \ + Description: Simplified view of removed inbox rule events for the user. + + File: User_Inbox_Rules_Removal_.csv/.json + Path: \ + Description: Detailed audit log data for removed inbox rules for the user. + + File: _Investigate_User_Inbox_Rules_Removal_.csv/.json + Path: \ + Description: A subset of historically removed rules flagged as suspicious. + + .EXAMPLE + Get-HawkUserUALInboxRuleRemoval -UserPrincipalName user@contoso.com + + Retrieves inbox rule removal events from the audit logs for user@contoso.com. + + .EXAMPLE + Get-HawkUserUALInboxRuleRemoval -UserPrincipalName (Get-Mailbox -Filter {CustomAttribute1 -eq "C-level"}) + + Retrieves inbox rule removal events for all users with CustomAttribute1 set to "C-level". + + .LINK + Get-HawkTenantAdminInboxRuleRemoval + Get-HawkUserInboxRule + #> + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [array]$UserPrincipalName + ) + + # Check if Hawk object exists and is fully initialized + if (Test-HawkGlobalObject) { + Initialize-HawkGlobalObject + } + + Test-EXOConnection + Send-AIEvent -Event "CmdRun" + + # Verify our UPN input + [array]$UserArray = Test-UserObject -ToTest $UserPrincipalName + + foreach ($Object in $UserArray) { + [string]$User = $Object.UserPrincipalName + + Out-LogFile "Initiating collection of inbox rule removal events for $User from the UAL." -Action + + try { + # Build search command for unified audit log - specific to this user + $searchCommand = "Search-UnifiedAuditLog -RecordType ExchangeAdmin -Operations 'Remove-InboxRule' -UserIds $User" + [array]$RemovedInboxRules = Get-AllUnifiedAuditLogEntry -UnifiedSearch $searchCommand + + if ($RemovedInboxRules.Count -gt 0) { + Out-LogFile ("Found " + $RemovedInboxRules.Count + " inbox rule removal events for $User in the audit logs.") -Information + + # Process and output the results + $ParsedRules = $RemovedInboxRules | Get-SimpleUnifiedAuditLog + + if ($ParsedRules) { + # Output simple format for easy analysis + $ParsedRules | Out-MultipleFileType -FilePrefix "Simple_User_Inbox_Rules_Removal" -csv -json -User $User + + # Output full audit logs for complete record + $RemovedInboxRules | Out-MultipleFileType -FilePrefix "User_Inbox_Rules_Removal" -csv -json -User $User + + # Check for suspicious removals using the helper function + $SuspiciousRemovals = $ParsedRules | Where-Object { + $reasons = @() + Test-SuspiciousInboxRule -Rule $_ -Reasons ([ref]$reasons) + } + + if ($SuspiciousRemovals) { + Out-LogFile "Found $($SuspiciousRemovals.Count) suspicious inbox rule removal events for $User." -Notice + Out-LogFile "Please verify this activity is legitimate." -Notice + $SuspiciousRemovals | Out-MultipleFileType -FilePrefix "_Investigate_User_Inbox_Rules_Removal" -csv -json -User $User -Notice + } + } + else { + Out-LogFile "Error: Failed to parse inbox rule removal audit data for $User." -isError + } + } + else { + Out-LogFile "No inbox rule removal events found in audit logs for $User." -Information + } + } + catch { + Out-LogFile "Error analyzing inbox rule removals for $User : $_" -isError + Write-Error -ErrorRecord $_ -ErrorAction Continue + } + + Out-LogFile "Completed collection of inbox rule removal events for $User from the UAL." -Information + } +} \ No newline at end of file diff --git a/Hawk/functions/User/Start-HawkUserInvestigation.ps1 b/Hawk/functions/User/Start-HawkUserInvestigation.ps1 index 5074839..8c633b8 100644 --- a/Hawk/functions/User/Start-HawkUserInvestigation.ps1 +++ b/Hawk/functions/User/Start-HawkUserInvestigation.ps1 @@ -169,6 +169,24 @@ Get-HawkUserInboxRule -User $User } + if ($PSCmdlet.ShouldProcess("Running Get-HawkUserUALInboxRuleCreation for $User")) { + Write-Output "" + Out-LogFile "Running Get-HawkUserUALInboxRuleCreation." -Action + Get-HawkUserUALInboxRuleCreation -User $User + } + + if ($PSCmdlet.ShouldProcess("Running Get-HawkUserUALInboxRuleModification for $User")) { + Write-Output "" + Out-LogFile "Running Get-HawkUserUALInboxRuleModification." -Action + Get-HawkUserUALInboxRuleModification -User $User + } + + if ($PSCmdlet.ShouldProcess("Running Get-HawkUserUALInboxRuleRemoval for $User")) { + Write-Output "" + Out-LogFile "Running Get-HawkUserUALInboxRuleRemoval." -Action + Get-HawkUserUALInboxRuleRemoval -User $User + } + if ($PSCmdlet.ShouldProcess("Running Get-HawkUserEmailForwarding for $User")) { Write-Output "" Out-LogFile "Running Get-HawkUserEmailForwarding." -Action diff --git a/Hawk/internal/WorkInProgress/Get-HawkUserHiddenRule.ps1 b/Hawk/internal/WorkInProgress/Get-HawkUserHiddenRule.ps1 deleted file mode 100644 index 9a328e2..0000000 --- a/Hawk/internal/WorkInProgress/Get-HawkUserHiddenRule.ps1 +++ /dev/null @@ -1,149 +0,0 @@ -Function Get-HawkUserHiddenRule { - <# - .SYNOPSIS - Pulls inbox rules for the specified user using EWS. - .DESCRIPTION - Pulls inbox rules for the specified user using EWS. - Searches the resulting rules looking for "hidden" rules. - - Requires impersonation: - https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-configure-impersonation - - Since the rules are hidden we have to pull it as a message instead of a rule. - That means that the only information we can get back is the ID and Priority of the rule. - Once a mailbox has been identified as having a hidden rule please use MFCMapi to review and remove the rule as needed. - - https://blogs.msdn.microsoft.com/hkong/2015/02/27/how-to-delete-corrupted-hidden-inbox-rules-from-a-mailbox-using-mfcmapi/ - .PARAMETER UserPrincipalName - Single UPN of a user, comma separated list of UPNs, or array of objects that contain UPNs. - .PARAMETER EWSCredential - Credentials of a user that can impersonate the target user/users. - Gather using (get-credential) - Does NOT work with MFA protected accounts at this time. - .OUTPUTS - - File: _Investigate.txt - Path: \ - Description: Adds any hidden rules found here to be investigated - - File: EWS_Inbox_rule.csv - Path: \ - Description: Inbox rules that were found with EWS - .EXAMPLE - - Get-HawkUserHiddenRule -UserPrincipalName user@contoso.com -EWSCredential (get-credential) - - Searches user@contoso.com looking for hidden inbox rules using the provided credentials - .EXAMPLE - - Get-HawkUserHiddenRule -UserPrincipalName (get-mailbox -Filter {Customattribute1 -eq "C-level"}) - - Looks for hidden inbox rules for all users who have "C-Level" set in CustomAttribute1 - #> - - ############################################################################################### - #TODO SEE TICKET DETAILS FOR THIS: https://github.com/T0pCyber/hawk/issues/265 - ############################################################################################### - - param ( - [Parameter(Mandatory = $true)] - [array]$UserPrincipalName, - [System.Management.Automation.PSCredential]$EWSCredential - ) - - # Check if Hawk object exists and is fully initialized - if (Test-HawkGlobalObject) { - Initialize-HawkGlobalObject - } - - - Test-EXOConnection - Send-AIEvent -Event "CmdRun" - - # Verify our UPN input - [array]$UserArray = Test-UserObject -ToTest $UserPrincipalName - - # Process each object received - foreach ($Object in $UserArray) { - - # Push the UPN into $user for ease of use - $user = $Object.UserPrincipalName - - # Determine if the email address is null or empty - [string]$EmailAddress = (Get-EXOMailbox $user).PrimarySmtpAddress - if ([string]::IsNullOrEmpty($EmailAddress)) { - Out-LogFile "No SMTP Address found. Skipping." -isWarning - return $null - } - - # If we don't have a credential object, ask for credentials - if ($null -eq $EWSCredential) { - Out-LogFile "Please provide credentials that have impersonation rights to the mailbox you are looking to check" -Information - $EWSCredential = Get-Credential - } - - # Import the EWS Managed API - if (Test-Path 'C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll') { - Out-LogFile "EWS Managed API Found" -Information - } else { - Write-Error "Please install EWS Managed API 2.2 `nhttp://www.microsoft.com/en-us/download/details.aspx?id=42951" -ErrorAction Stop - } - - # Import the EWS Managed API DLL - Import-Module 'C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll' - - # Set up the EWS Connection - Write-Information ("Setting up connection for " + $EmailAddress) - $exchService = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService -ArgumentList ([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2013_Sp1) - $exchService.Credentials = New-Object Microsoft.Exchange.WebServices.Data.WebCredentials($EWSCredential.Username, $EWSCredential.GetNetworkCredential().Password) - - # Autodiscover or use global EWS URL - if ($null -eq $EWSUrl) { - $exchService.AutodiscoverUrl($EmailAddress, { $true }) - $exchService.Url | Set-Variable -Name EWSUrl -Scope Global - } else { - $exchService.Url = $EWSUrl - } - - # Set impersonation - $exchService.ImpersonatedUserId = New-Object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $EmailAddress) - - # Add the Anchor mailbox to the HTTP header - $exchService.HttpHeaders.Add("X-AnchorMailbox", [string]$EmailAddress) - - # Search for hidden rules - $SearchFilter = New-Object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.ItemSchema]::ItemClass, "IPM.Rule.Version2.Message") - $ItemView = New-Object Microsoft.Exchange.WebServices.Data.ItemView(500) - $ItemView.Traversal = [Microsoft.Exchange.WebServices.Data.ItemTraversal]::Associated - - # Create our property set to view - $PR_RULE_MSG_NAME = New-Object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x65EC, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String) - $PR_RULE_MSG_PROVIDER = New-Object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x65EB, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String) - $PR_PRIORITY = New-Object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(0x0026, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::Integer) - $psPropset = New-Object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::IDOnly, $PR_RULE_MSG_NAME, $PR_RULE_MSG_PROVIDER, $PR_PRIORITY) - - # Add the property set to the item view - $ItemView.PropertySet = $psPropset - - # Do the search and return the items - $ruleResults = $inbox.FindItems($SearchFilter, $ItemView) - - # Check each rule directly from $ruleResults - $FoundHidden = $false - foreach ($rule in $ruleResults) { - if ([string]::IsNullOrEmpty($rule.ExtendedProperties[0].Value) -or [string]::IsNullOrEmpty($rule.ExtendedProperties[1].Value)) { - $priority = ($rule.ExtendedProperties | Where-Object { $_.PropertyDefinition.Tag -eq 38 }).Value - Out-LogFile ("Possible Hidden Rule found in mailbox: " + $EmailAddress + " -- Rule Priority: " + $priority) -Notice - $RuleOutput = $rule | Select-Object -Property ID, @{ Name = "Priority"; Expression = { ($rule.ExtendedProperties | Where-Object { $_.PropertyDefinition -like "*38*" }).Value } } - $RuleOutput | Out-MultipleFileType -FilePrefix "EWS_Inbox_rule" -Txt -User $user -Append - $FoundHidden = $true - } - } - - # Log if no hidden rules are found - if ($FoundHidden -eq $false) { - Out-LogFile "Get-HawkUserHiddenRule completed successfully" -Information - Out-LogFile ("No Hidden rules found for mailbox: " + $EmailAddress) -action - } - } -}