<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Email Lateral Phishing

## Commands

| Command | Description |
|---|---|
| `Get-MessageTrace -SenderAddress` | Trace messages sent by specific user |
| `Search-UnifiedAuditLog -Operations MailItemsAccessed` | Audit mailbox access patterns |
| `Revoke-AzureADUserAllRefreshToken` | Revoke all active sessions |
| `New-ComplianceSearch` | Search and purge phishing messages |
| `Get-InboxRule -Mailbox` | Check for attacker-created inbox rules |
| `Set-User -AccountDisabled` | Disable compromised user account |
| `Get-MailboxAuditBypassAssociation` | Check for audit bypass |

## Agent Script

```bash
# node agent.js detect --user <value>
# node agent.js graph --user <value>
# node agent.js contain --user <value>
```
