At one point of my career, the need to purge user mailboxes from phishing attempts became more and more common.

If you read my about me, It's safe to assume I initiated the Idea to automate the manual effort it takes to Block & Purge phishing attempt.

You can download the script here via Git clone https://github.com/ctejeda/Invoke-PhishingEmailPurge.git

Keep in mind, The script was designed to work with the following technologies:

• Office 365 (Exchange)
• Mimecast (Email Filtering)
• PowerShell

Once you've downloaded the script, edit lines 46,47,48, & 49 with your Mimecast info.

Save your changes.

Now we can issue the following command to purge all user mailboxes that have message from the sender you enter in the next line:
Invoke-PhishingEmailPurge -PhishingEmail "BadSender@baddomain.com" -Logfile "\some\log\directory"

Once the command is issued, You will be promoted to enter Admin credentials for Office 365.

The first section of the script called is the Mimecast API.

The API call adds the BadSender@baddomain.com to Mimecast's block list. This means no more emails from the above sender.

The process then proceeds to purge email from user mailboxes. If successful, you should see some output in the log file.

As a result, the email is removed and deleted from the user "Chris Tejeda's" Office 365 Mailbox.

Comments