365 Deleting malicious email using the admin console

We all get those forwarded emails that made it into Office 365 that hopefully an end user asks “is this legit” or “this looks fake”. Unfortunately, filtering can only do so much. This article will review how to quickly purge those emails a thread a time from your Office 365 exchange environment and thus your end users outlook. Preventing that user that doesn’t ask and always clicks first and asks later from doing harm.

IMPORTANT NOTE: If your query legitimate or not contains more than 10 emails per mailbox or more that 50,000 mailboxes this will not work as you may have intended. If you have more than 10 it may only delete the first 10 it finds per mailbox. If you run it over and over again it still won’t remove any more. This tool is ONLY for surgical removal of a single email blast.

First we need to create a content search:

Open Office365 using Microsoft Edge logon as an Administrator and Open “Security and Compliance” console:

or

Drill down to “Search and Investigations” and “Content search” as shown below:

Click on the + to add a new search, Name the search and specify locations to search and click “Next” as shown below:

Now put in your search keywords and or any conditions. CAUTION! If you put in something too short or vague and don’t qualify it with a condition, you may get more results than you intended. I used the path to the phishing link as my keyword, but I made an intentional mistake for your benefit.

Note: you can change the conditions as needed if you don’t get the results intended.

Once you click “Search” it will begin immediately searching your “indexed” database:

Note: Indexed means email and data it can scan and index. It may skip attachments or larger email threads.

To the right you will see the search results. As you can see below my search grabbed all the wrong data. To view what emails it found you can “preview search results”:

The reason the query grabbed too much is because I had https:// in front of my keyword search. Once I modified that to only “nathatransport.co.th” and reran the Search it found the following 2 items I intended it to find:

Reminder: If your query legitimate or not contains more than 10 emails per mailbox or more that 50,000 mailboxes this will not work! If you have more than 10 it may only delete the first 10 it finds. If you run it over and over again it still won’t remove any more. This tool is ONLY for surgical removal of a single email blast.

Clean using search results:

Now that you have your search results we can now run the Powershell commands to access those results and purge those emails.

First you need to connect to the 365 Exchange server with Powershell as an Administrator and run the following commands:

Create a Powershell script and call it 365SCC.ps1 copy in the following commands and run it, or run the following commands individually:

Set-ExecutionPolicy RemoteSigned

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic –AllowRedirection

Import-PSSession $Session -AllowClobber -DisableNameChecking

$Host.UI.RawUI.WindowTitle = $UserCredential.UserName + " (Office 365 Security & Compliance Center)"

Now you run the deletion command separately:

New-ComplianceSearchAction -SearchName "Insert Name Here" -Purge -PurgeType SoftDelete

A few minutes later to Confirm the email “soft” deleted. I opened up my test mailbox and went to deleted items. The email will not show there since it was “Soft Deleted” so click on “Recover deleted items” as shown below:

Now you can see the email is in the Deleted Items recovery bin which it will remain for the standard Deleted Items Retention policy timeframe (typically 30 days) before full deletion.

Note: If you run the Query again, those email will still be listed as the query will still find them in deleted items recovery bin until hard deletion happens.

Congratulations you now know how to surgically clean malicious email from your Exchange 365 environment.

If you need scripts to purge more than 10 items per mailbox or 50,000 mailboxes that may become available in future releases of this tool from Microsoft.