📘
DFIR
Ctrlk
  • Networking
    • Networking
  • Windows
    • Administration
    • Forensics
      • System Info
      • Memory
      • Network Logs
      • File System
      • Registry
      • Network Share
      • Exfiltration
      • Evidence of Execution
      • Hacktool Artifacts
      • Event Logs
        • Event Log IDs
        • Windows Defender
        • LOLBins
        • DNS Logs
        • Application NTDS.dit
        • Kerberos
        • Exchange
        • GPOs and OUs
        • Anti Forensics
      • 3rd Party Apps
      • Example Page
    • Cheat Sheet
    • Investigation
    • Internals
    • Active Directory
    • MISC
  • Linux
    • Forensics
    • SSH
    • Linux WebShells
    • Directories of Interest
    • Internals
  • Enterprise Architecture
    • CI/CD Pipline
    • Citrix
    • Web Applications
    • The Cloud
    • vSphere
    • Containers
    • Troubleshooting
  • Mac
    • Forensics
  • Attacker Information
    • Adversary Operations
    • Actor Playbooks
    • Abused Domains
  • IR Playbook
    • Activity from Unmanaged Host
    • Recommendations
  • Reverse Engineering
    • Python - Pyinstaller
Powered by GitBook
On this page
  • Message Trace
  • Log Files:
  1. Windows
  2. Forensics
  3. Event Logs

Exchange

LogoPwned by the Mail CarrierMedium

client side only rule

Message Trace

LogoHow to Tell Which Transport Rule Was Applied to an Email MessagePractical 365

LogoSearch-MailboxAuditLog (ExchangePowerShell)MicrosoftLearn
LogoMailbox audit logging in Exchange ServerMicrosoftLearn

Log Files:

Web Logs:

  • C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy

PreviousKerberosNextGPOs and OUs

Last updated 1 year ago