Everyday security teams combat malicious email attacks. Have you ever needed to search and remove messages from your users mailboxes but didn't know or want to use PowerShell CmdLets to do so? What if you wanted to do this on macOS or *Nix systems? Well you can now with pyews. During this talk I will be walking through a Python package I wrote that interacts directly with Exchange Web Services using SOAP based requests. This package allows the user to use their own credentials or use Impersonation. This Python package has implemented AutoDiscover capabilities and all the eDiscovery endpoints to gather all searchable mailboxes, search them, and delete a message from users mailboxes. Additionally, this package supports many additional endpoints (move item, new folder, etc.) plus lots more to interact with your Office 365 or Exchange on-premises environments (Exchange 2010 - Office 2016/Office 365).

Josh’s primary focus is in Windows security, PowerShell and Python automation. He is a GIAC Certified Windows Security Administrator (GCWN) and GIAC Certified Forensic Analyst (GCFA). You can reach Josh at letsautomate.it or on Twitter at @MSAdministrator.

Back to BSidesSTL 2019 video list