from typing import Any

def pre_migration_checklist(source: str, target: str) -> dict[str, Any]:
    checks = {
        "spf_record_documented": False,
        "dkim_keys_exported": False,
        "dmarc_policy_recorded": False,
        "retention_policies_mapped": False,
        "legal_holds_identified": False,
        "admin_accounts_audited": False,
        "mfa_enforced_target": False,
        "encryption_at_rest_target": False,
        "conditional_access_planned": False,
        "third_party_integrations_listed": False,
    }
    return {
        "source": source,
        "target": target,
        "checklist": checks,
        "status": "incomplete",
    }

# Verify TLS on source SMTP
openssl s_client -connect mail.source.com:587 -starttls smtp 2>/dev/null | \
  grep -E "(Protocol|Cipher|Server certificate)"

# Verify TLS on target SMTP
openssl s_client -connect mail.target.com:587 -starttls smtp 2>/dev/null | \
  grep -E "(Protocol|Cipher|Server certificate)"

# Check migration tool uses encrypted channel
# Verify no plaintext IMAP (port 143) — only IMAPS (993)
nmap -p 143,993,587,465 mail.source.com --script ssl-enum-ciphers

# Document current records BEFORE cutover
dig MX example.com +short > pre_migration_mx.txt
dig TXT example.com +short | grep "v=spf1" > pre_migration_spf.txt
dig TXT _dmarc.example.com +short > pre_migration_dmarc.txt
dig TXT selector1._domainkey.example.com +short > pre_migration_dkim.txt

# Post-cutover — verify new records propagated
dig MX example.com +short
dig TXT example.com +short | grep "v=spf1"

# Lower DMARC to monitor during transition
# v=DMARC1; p=none; rua=mailto:[email protected]; pct=100
# Then progressively enforce: none -> quarantine -> reject

# Verify MFA enforcement on target tenant
Get-MgUser -All | Where-Object { $_.StrongAuthenticationMethods.Count -eq 0 } |
  Select-Object UserPrincipalName

# Verify retention policies migrated
Get-RetentionPolicy | Select-Object Name, RetentionPolicyTagLinks

# Verify no orphaned mailbox permissions
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission |
  Where-Object { $_.User -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false }

# Verify conditional access policies active
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State

title: Email Migration Security Detection
id: 06cc5a6e-6311-4250-86af-0ab67f287554
status: experimental
description: Detects suspicious activity related to performing email migration security techniques in email security context
logsource:
  category: email
  service: exchange
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: medium
tags:
  - attack.t1114
  - attack.t1530
  - attack.initial_access
falsepositives:
  - Bulk email migration by authorized IT administration tools