competition-mailbox-abuse

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Use this skill only as a downstream specialization after

$ctf-sandbox-orchestrator

is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to

$ctf-sandbox-orchestrator

first.

Use this skill when the decisive path runs through mailbox behavior, consent flow, or message-routing effects rather than generic AD evidence alone.

Reply in Simplified Chinese unless the user explicitly requests English.

本技能仅可作为下游专项能力，在

$ctf-sandbox-orchestrator

已激活并完成沙箱假设、节点归属、证据优先级确认后使用。如果上述前置条件未满足，请先返回

$ctf-sandbox-orchestrator

流程。

当问题的核心判定路径围绕邮箱行为、授权流程或消息路由效果展开，而非仅依赖通用AD证据时，使用本技能。

除非用户明确要求使用英文，否则请用简体中文回复。

Decide whether the active path is phishing-to-consent, token-to-mailbox, rule-based persistence, or transport-level mail rerouting.
Keep mailbox evidence, identity evidence, and message-trace evidence tied to the same user, mailbox, token, or message ID.
Separate possession of a token or delegate edge from the actual mailbox effect it enables.
Record forwarding targets, rule predicates, consent scopes, shared mailbox edges, and resulting mail flow in compact blocks.
Reproduce the smallest mail effect that proves persistence, exfiltration, or privilege.

Identify the principal, mailbox, token or session, consent grant, delegate edge, shared mailbox relationship, or app registration involved.
Record consent scopes, mailbox permissions, rule ownership, transport actions, and message-trace identifiers.
Distinguish client-visible symptoms from server-side mailbox or transport state.

Correlate consent logs, sign-ins, message traces, inbox rules, transport rules, forwarding settings, and mailbox audit events.
Show which rule or token produces which concrete effect: silent forwarding, marking read, deletion, delegate access, or message rerouting.
Keep message IDs, sender or recipient pairs, and timestamps aligned across logs.

Compress the path to the smallest sequence: lure or grant -> token or delegate edge -> mailbox or transport mutation -> resulting mail effect.
State clearly whether persistence lives in consent, mailbox rules, transport config, or shared mailbox permissions.
If the task broadens into host pivots or Kerberos acceptance, switch back to the broader identity skill.

Load
```
references/mailbox-abuse.md
```
for the consent checklist, rule checklist, and evidence packaging.

Consent scopes, token claims, mailbox permissions, rule definitions, forwarding targets, and message IDs
Message-trace lines, audit events, and mailbox effects tied to the same mail path
The smallest replayable sequence that proves persistence, exfiltration, or delegate access