Skip to content
Threat Feed
Subscribe

Product

Exchange

6 briefs RSS
high advisory

Microsoft Security Updates — July 2026

Roundup of Microsoft security advisories published in July 2026.

PoC PowerShell +511 roundup
11c 354i updated
medium advisory

Exchange Mailbox Export via PowerShell

Adversaries may use the `New-MailboxExportRequest` PowerShell cmdlet to export mailboxes to PST files for sensitive data collection.

Exchange email-collection powershell
2r 4t
high advisory

O365 Elevated Mailbox Permission Assignment

Detection of elevated mailbox permissions (FullAccess, ChangePermission, ChangeOwner) being assigned in Office 365, potentially leading to unauthorized access, data exfiltration, or privilege escalation.

Office 365 +1 o365 mailbox-permissions privilege-escalation
2r 1t
high advisory

O365 BEC Email Hiding Rule Creation

This analytic detects suspicious Office 365 mailbox rule creation, a common technique used in Business Email Compromise (BEC), by scoring rule attributes like short names, marking emails as read, and moving emails to specific folders.

Office 365 +1 bec office365 email
2r 2t
medium advisory

Exchange Mailbox Export via PowerShell

Adversaries may use the New-MailboxExportRequest PowerShell cmdlet to export mailboxes in Exchange, potentially leading to sensitive information theft.

Microsoft Defender XDR +2 collection execution powershell exchange mailbox
2r 4t
high advisory

Azure AD Device Code Phishing Attack Detection

This brief details the detection of Azure AD Device Code Phishing attacks, where attackers bypass MFA and Conditional Access Policies (CAPs) to gain unauthorized access to Azure AD resources by abusing the device code authentication protocol.

Azure Active Directory +2 azuread devicecode phishing accounttakeover credentialaccess
2r 2t