We're a school using Exchange Online and have had several users click on a link in a phishing email with a compromised link. Their accounts each started sending lots of messages, and thankfully most (all but 1) accounts were flagged in
Security & Compliance Restricted Users, which stopped the attack. Now my job is to (a) clear out those messages and (b) create a spam detection rule.
A quick exchange-online-powershell
Search-Mailbox doesn't seem to let me identify html code in the dodgy sent emails. Each sent email has unique subject and body text, but common html wrappers (think styled color, font, etc.) around the body text. Can anyone help identify a way to clear out my messages based on
html bodytype? I'm hoping the same match method will help me create an Exchange mail flow rule to quarantine any future inbound messages.
