<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-archival-security
description: >-
  Implement secure email archival with integrity verification, encryption at
  rest, access controls, tamper detection, and compliance-ready retention for
  legal hold and eDiscovery requirements.
domain: cybersecurity
subdomain: email-security
tags:
  - archival
  - retention
  - integrity
  - ediscovery
  - legal-hold
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1114", "T1485"]
  tools: [exchange-powershell, m365-compliance, openssl, sha256sum]
---

# Implementing Email Archival Security

## Overview

Secure email archival ensures message integrity, confidentiality, and
availability for compliance and legal requirements. Covers immutable storage,
cryptographic integrity verification, encryption at rest, granular access
controls, and legal hold capabilities.

## Prerequisites

- Tools: Exchange PowerShell, openssl, sha256sum
- Archive storage infrastructure
- Legal and compliance requirements documentation

## Key Concepts

- **Immutable storage**: Write-once archives preventing modification
- **Integrity manifests**: SHA256 hashes verifying archive contents
- **Legal hold**: Preserving data for litigation or regulatory request
- **eDiscovery**: Searching archived email for legal production

## Workflow

### Step 1: Archive Configuration

```powershell
# Enable archive mailbox
Enable-Mailbox -Identity "user@example.com" -Archive

# Configure auto-expanding archive
Set-Mailbox -Identity "user@example.com" -AutoExpandingArchive

# Verify archive status
Get-Mailbox -Identity "user@example.com" | Select ArchiveStatus, ArchiveQuota
```

### Step 2: Integrity Verification

```bash
# Generate hash manifest
find /archive/email/ -name "*.eml" -exec sha256sum {} \; > manifest.sha256

# Verify integrity
sha256sum -c manifest.sha256

# Sign manifest for tamper evidence
openssl dgst -sha256 -sign private.key -out manifest.sig manifest.sha256
openssl dgst -sha256 -verify public.key -signature manifest.sig manifest.sha256
```

### Step 3: Access Control and Legal Hold

```powershell
# Place on litigation hold
Set-Mailbox -Identity "user@example.com" \
  -LitigationHoldEnabled $true \
  -LitigationHoldDuration 2555

# Review archive permissions
Get-MailboxPermission -Identity "user@example.com" |
  Where {$_.AccessRights -match "FullAccess"}

# Restrict access
Remove-MailboxPermission -Identity "user@example.com" \
  -User "unauthorized@example.com" -AccessRights FullAccess
```

### Step 4: Encryption at Rest Verification

```powershell
# Check service encryption (M365)
Get-OMEConfiguration | Format-List

# Verify customer key if configured
Get-DataEncryptionPolicy | Select Name, State
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Archive access | Audit logs | Unauthorized archive access |
| Hold modification | Admin audit | Litigation hold changes |
| Integrity violation | File monitoring | Hash mismatch in manifest |

```yaml
title: Email Litigation Hold Removed
id: d0e1f2a3-b4c5-6789-d012-012345678901
status: experimental
description: Detects removal of litigation hold indicating possible evidence tampering
logsource:
  category: application
  product: m365
detection:
  selection:
    Operation: "Set-Mailbox"
    Parameters|contains: "LitigationHoldEnabled:False"
  condition: selection
falsepositives:
  - Authorized hold release after case closure
level: critical
tags:
  - attack.t1485
  - attack.impact
```

## Verification

- [ ] Archive mailboxes enabled with appropriate policies
- [ ] Integrity manifests generated and signed
- [ ] Legal hold functional and tested
- [ ] Access controls restrict archive to authorized personnel
- [ ] Encryption at rest verified

## References

- [Microsoft Archive Mailboxes](https://learn.microsoft.com/en-us/purview/enable-archive-mailboxes)
- [NIST SP 800-53 AU-9](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [SEC Rule 17a-4](https://www.sec.gov/rules/final/34-38245.txt)
