<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Email Account Compromise

## Azure AD / KQL
```kql
SigninLogs | where ResultType == 0 | summarize make_set(Location) by UserPrincipalName
SigninLogs | where ResultType != 0 | summarize count() by UserPrincipalName
AuditLogs | where OperationName == "Consent to application"
```

## Exchange PowerShell
```powershell
Get-InboxRule -Mailbox "user@example.com" | Format-List
Get-Mailbox | Where {$_.ForwardingSmtpAddress} | Select DisplayName, ForwardingSmtpAddress
Search-UnifiedAuditLog -Operations "New-InboxRule" -StartDate (Get-Date).AddDays(-7)
```
