I85PREP
⌘ K
CC-CEM study materials
CC-CEM study resources

Business Email Compromise: Containing a Mailbox Rule and Preserving Evidence

CC-CEM · Put your knowledge to work in context.

All case studies

Business Email Compromise: Containing a Mailbox Rule and Preserving Evidence

Adventure Works has 5,000 mailboxes in Exchange Online, 30-day mailbox audit log retention, and a third-party SIEM ingesting the Unified Audit Log with 90-day retention. On a Friday, the AP clerk reports that a vendor's bank details changed by email; the message came from a legitimate vendor domain but a lookalike display name. Finance paid $186,000 to the new account. Investigation shows the AP clerk's mailbox had an inbox rule created 9 days earlier that moved messages from the real vendor to Conversation History and marked them read. The rule was created from an IP in another country. The clerk's account had no MFA; Conditional Access was in report-only mode. The attacker also created a mailbox rule in the CFO's mailbox, and 14 other users received similar messages. The legal team asks for a forensic hold, and the insurer asks for timeline evidence. The CIO wants to know whether to wipe the clerk's device.

1. What containment and evidence-preservation steps would you take in the first 24 hours?

Read the worked answer

First 24 hours:

  1. Preserve before you change: place litigation hold on the AP clerk, CFO, and the 14 recipients; export Unified Audit Log, mailbox audit logs, message trace, sign-in logs, and the rule itself. The 30-day mailbox audit retention is the binding constraint; export now.
  2. Contain identity: reset passwords, revoke refresh tokens and sessions, require MFA re-registration, review MFA methods and OAuth grants. Disable the account only if you can still preserve the mailbox; disabling does not delete it.
  3. Remove attacker persistence: delete inbox rules in all affected mailboxes, and check delegate access, forwarding, and transport rules.
  4. Scope: search for the attacker IP, sender domain, rule names, and messages to the fraudulent bank account. Notify the bank and insurer; preserve original message headers.
  5. Device: isolate the clerk's device from the network and take a forensic image. Do not wipe it; wiping destroys evidence and may be unnecessary if the compromise was credential-based. Reimage only after imaging and legal clearance.
  6. Communicate with legal, finance, the insurer, and the affected vendor.

2. How would you scope the compromise and determine whether the CFO mailbox was accessed?

Read the worked answer

Use multiple log sources and correlate:

  • Unified Audit Log for mailbox rule creation (New-InboxRule), Set-InboxRule, delegate changes, and sign-in events. Filter by the foreign IP and the 9-day window.
  • Entra ID sign-in logs for successful sign-ins from the IP, including interrupted and non-interactive sign-ins; check user agent and device.
  • Mailbox audit logs for MailItemsAccessed, SendAs, SendOnBehalf, and UpdateInboxRules; the CFO mailbox is in scope if the same IP or rule name appears.
  • Message trace for messages from the real vendor that were moved or marked read; compare with the rule's target folder.
  • eDiscovery search for the fraudulent bank details and the lookalike display name across all mailboxes.

The key is to export the 90-day SIEM copy before the 30-day mailbox audit rolls off, and to look for low-and-slow access rather than only the payment message. Absence of a sign-in does not prove no access if tokens were reused.

3. What control failures does this incident reveal, and what would you prioritize to prevent recurrence?

Read the worked answer

Control failures: no MFA, Conditional Access in report-only instead of enforced, no alert on inbox rule creation, no out-of-band verification for bank-detail changes, and audit retention shorter than the investigation window. Prioritize:

  • Enforce MFA and block legacy authentication; move CA to enforce for all users, with break-glass exceptions.
  • Alert on New-InboxRule and forwarding changes, especially from new IPs or countries.
  • Require callback verification for any vendor bank change; add a warning banner to external mail and a payment-change workflow.
  • Extend mailbox audit log retention to 180 days or stream to the SIEM; test eDiscovery preservation.
  • Tabletop the BEC playbook with finance and legal; pre-agree bank notification and insurer evidence pack.

The device wipe question is secondary; the identity and process controls were the real gaps.