Business Email Compromise With an Active Mailbox
At 09:10 on a Friday, a finance analyst at Tailspin (tailspin.example) reports that a vendor's email thread now shows a different bank account. Investigation finds the analyst's Microsoft 365 account was accessed from an unfamiliar Nigerian IP using a valid password and no MFA prompt. The attacker created an inbox rule moving messages containing 'invoice' to RSS Feeds, registered a new MFA method, and sent 14 emails from the account to five external vendors. The tenant has 1,500 users, MFA enforced for admins only, and 90-day retention. Legal says a wire transfer of $180,000 may have left the bank that morning; the vendor denies the change. The account is still active. The SOC has E5, audit logging on, and a 30-day Sentinel retention. The CFO wants the mailbox deleted immediately.
1. What is the correct containment sequence, and why should the mailbox not be deleted immediately?
Read the worked answer
Contain without destroying evidence. Order:
- Place the mailbox on eDiscovery/legal hold and export relevant audit, sign-in, and message-trace data. Deleting the mailbox destroys evidence and may breach legal obligations.
- Block sign-in, reset the password, revoke refresh tokens and sessions, remove the attacker's MFA method, and delete inbox rules and forwarding.
- Review OAuth consent grants, delegate access, and mailbox permissions for persistence.
- Notify the bank fraud line and the five vendors by phone using known numbers, not reply-to addresses.
- Enable MFA for all users and review conditional access gaps that allowed password-only access.
- Notify legal, privacy, and management.
The CFO's instinct is understandable but wrong: disable the account and preserve content. Deletion would also remove the sent items and rules needed to scope the incident and support any recovery or regulatory response.
2. What hunting queries and data sources would you use to determine scope?
Read the worked answer
Use unified audit log and Entra sign-in logs for the source IP, user agent, and time window; message trace for all mail sent from the account; audit events for New-InboxRule/Set-InboxRule, MFA registration changes, OAuth consent, and mailbox delegation. Search the RSS Feeds folder and any forwarding configuration. Pivot on the source IP and user agent across all 1,500 users to find other compromised accounts, and check for password-spray or legacy-auth patterns.
In Sentinel, correlate AuditLogs, SigninLogs, EmailEvents, and EmailUrlInfo. Review the vendor thread for a lookalike domain and check whether the 14 messages included BCC recipients or attachments. Also inspect the sent items for bank-detail changes and replies. Because Sentinel retains 30 days, export the relevant windows now. Scope is not limited to five vendors; the attacker may have used the mailbox to phish internally or to establish forwarding rules that exfiltrate future mail.
3. What evidence-preservation, notification, and recovery steps are required after containment?
Read the worked answer
Preserve audit logs before the 30-day Sentinel window closes: export to immutable storage, record hashes or export metadata, and document chain of custody. Legal hold preserves mailbox content but not all logs, so both are needed. Notify the bank's fraud unit immediately and attempt recall of the $180,000; notify the five vendors and any affected internal parties. Legal determines regulatory notification based on jurisdiction and data involved.
Recovery: reset the password, require MFA re-registration, review conditional access, and confirm the initial access vector. The absence of an MFA prompt with a valid password suggests password compromise plus a policy gap, legacy authentication, or token theft; check sign-in logs for authentication method. After restoring access, monitor the account for 30 days. Finally, conduct a lessons-learned review covering MFA coverage for all users, inbox-rule alerting, and vendor bank-change verification procedures.