Business Email Compromise with a Hidden Inbox Rule
At 09:12 on Monday, the finance director at a 600-employee manufacturer reports that a vendor’s bank details changed by email last Thursday. A payment of $48,000 was sent Friday to the new account. The email came from the vendor’s correct domain but from a display name “Accounts Payable.” The SOC finds that on Wednesday, a finance analyst entered credentials on a lookalike Microsoft 365 login page after clicking a link in a “shared invoice” email. The analyst’s account has MFA via SMS. The attacker authenticated from an IP in Nigeria at 02:40 Thursday, created an inbox rule to move messages containing “invoice,” “payment,” or “bank” to RSS Feeds, and sent 14 emails to other finance staff. Three of those recipients replied with mailbox credentials. The vendor confirms it did not change banks. The payment has not yet been recalled. The CFO asks, “Can we just reset the analyst’s password and move on?”
1. What containment actions are needed in the first hour, in what order, and why?
Read the worked answer
Stop the money first: call the bank’s fraud line and the vendor using a previously known phone number, request recall of the $48,000, and preserve the payment instructions and email headers. Then contain identity: revoke all refresh tokens and active sessions for the analyst and the three recipients, reset passwords, and re-register MFA - preferably moving off SMS to an authenticator app or FIDO2. Do not just reset the analyst’s password. The attacker created an inbox rule and may still have a valid token; a password reset alone can leave sessions and rules active. Remove or disable the malicious inbox rule only after capturing it, check for delegate access, forwarding, and OAuth app consents, and block the Nigerian source IP and phishing domain at the mail gateway. Preserve sign-in logs, mailbox audit logs, message trace, and the original phishing email. Notify legal, the cyber insurer, and the vendor’s real AP contact. The order matters because financial recovery has the shortest window, while identity containment stops re-entry.
2. How would you scope the compromise and preserve evidence?
Read the worked answer
Scope from known indicators outward. Search Entra ID sign-in logs for the attacker IP, user agents, and any successful sign-ins for all finance users; look for MFA fatigue or token replay. Use mailbox audit logs for New-InboxRule, Set-InboxRule, UpdateInboxRules, Add-MailboxPermission, and Set-Mailbox forwarding. Run message trace for the 14 outbound emails and any replies containing credentials, then check sent items and deleted items. Review OAuth grants and enterprise applications for new consents. Check whether the three recipients’ accounts were accessed and whether any other mailbox rules exist. Preserve evidence with an eDiscovery hold, export logs to a write-once location, hash the exports, and keep a chain-of-custody record. Do not delete the rule, mailbox, or phishing email before capture; a screenshot is not sufficient. Build a timeline from Wednesday login through Friday payment and identify every account and vendor communication touched.
3. What legal, notification, and recovery steps follow?
Read the worked answer
Notify the cyber insurer and legal promptly, and follow the policy for law enforcement and fraud reporting; in the U.S., IC3 and the bank’s fraud unit are typical. The vendor must be told through a verified channel so it can warn its own customers. Determine whether personal or financial data was accessed; if so, privacy counsel must assess breach-notification duties. Recover by resetting credentials, revoking sessions and consents, removing rules, and re-enabling MFA. Change the payment process: callback verification using a known number, dual approval for bank-detail changes, and a hold period for new payees. Add detections for inbox-rule creation and impossible-travel sign-ins. Conduct a lessons-learned review that covers why SMS MFA and a lookalike domain succeeded, and track the $48,000 recovery outcome separately from the security remediation.