0_malicious_OWA_rules

# Get connected to Exchage Online Management
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName <UPN>

1_malicious_OWA_rules

#Search the RSS folders of all OWA users
$All = Get-Mailbox -ResultSize Unlimited
$Result=@() 
$All | foreach {
$obj =Get-MailboxFolderStatistics -Identity $_.Identity | Where {$_.Identity -match "RSS"} | select Identity,ItemsInFolderAndSubfolders,FolderAndSubfolderSize,LastModifiedTime
Write-Output $obj
$Result += $obj
}
$Result | Export-CSV "output.csv" -noType

2_malicious_OWA_rules

#Search the rules of all OWA users
#This dumps all rules for all users into a .csv file. You can search the CSV for things like "RSS" or "move the message to folder" to quickly identify malicous rules.
$All = Get-Mailbox -ResultSize Unlimited
$Result=@() 
$All | foreach {
$obj =Get-InboxRule -Mailbox $_.Identity
Write-Output $obj
$Result += $obj
}
$Result | Export-CSV "output.csv" -noType