Business Email Compromise: Preserve Before You Clean

Order matters because the attacker still has access and the configuration state is the evidence. A deleted rule may exist nowhere else if mailbox auditing was not enabled for that mailbox when it was created.

Preserve first, in this order:

1. Read live configuration without changing it: Get-InboxRule, Get-MailboxPermission, Get-MailboxFolderPermission, Get-OrganizationRelationship, and the OAuth grant list including consent time and consenting user.
2. Export the unified audit log for the mailbox and for admin activity across the whole tenant, plus Entra sign-in and audit logs, to write-once storage and hash the exports. Note that sign-in logs are the shortest-lived artefact at 30 days.
3. Export message trace for the forwarding domain and place the mailbox on eDiscovery hold.
4. Export the mailbox to PST before any cleanup, so forwarded and moved messages are captured as they stand.

Only then revoke refresh tokens and sessions, reset the password, enforce MFA, and remove the rule, delegate grants and illicit consent. Document the exact times of the rule's creation, its parameters and the source IPs, because that is what links the activity to a person or infrastructure. Tell the CFO plainly that deleting the rule first is the one action that cannot be undone, and that the board can be briefed with facts rather than a tidied mailbox.

Assume the credentials were obtained elsewhere and that this mailbox is one instance of a campaign. Work outward with concrete artefacts.

Unified audit log filtered on New-InboxRule, Set-InboxRule, Add-MailboxPermission, Add-MailboxFolderPermission, Set-Mailbox, and New-ApplicationAccessPolicy shows every other mailbox where the same pattern was created and which admin accounts were used. Message trace on the forwarding address and on the attacker ASNs shows the full set of senders and recipients, including internal users who replied. Entra sign-in logs pivoted on the two ASNs and their IP ranges reveal password-spray or token-replay attempts against other accounts, including failures. The OAuth consent record shows which application, which publisher and which scopes, and whether other users consented. Mailbox audit settings tell you whether coverage existed at the time of the activity, which bounds what you can prove. Transport rules and connectors need review, since an attacker who reaches admin rights can exfiltrate silently.

Correlate sign-in timestamps with the hosting ASN geolocation and with any successful MFA fatigue prompts. Produce a scope statement that separates confirmed compromised accounts from suspected ones, and keep checking new artefacts as log retention windows roll forward.

Explain the specific loss: the rule object carries its creation time, creator, forwarding address, keyword conditions and any hidden parameters. That record is often the only artefact proving intent and method, and if mailbox auditing did not cover the mailbox at creation time, deleting it erases the evidence. The same applies to the delegate grants and the OAuth consent.

Offer a bounded compromise: within 15 minutes, capture the rule and delegate configuration in a signed export and hash it; hand the CFO a one-page summary stating what was found and when; then disable forwarding at the transport level, which immediately stops exfiltration without destroying the rule object. If they still require deletion, schedule it after the export is verified and after legal confirms the hold, and record who authorised the deletion and when. Session revocation can proceed immediately because it does not remove configuration evidence and materially reduces risk.

Set the expectation that board communication does not require a clean mailbox, only an accurate statement of what is known, what is contained and what remains under investigation. Remove the pressure to sanitise by giving them a defensible narrative early.