Incident Response and Investigation for Email-Borne Attacks
Incident Response and Investigation for Email-Borne Attacks
This domain tests evidence handling and containment for phishing, malware, and business email compromise. You need a repeatable path from user report to scoped remediation.
Core rules
- Start with the message headers: Return-Path, Received chain, Authentication-Results, Message-ID, and X-MS-Exchange-Organization-Network-Message-Id. Headers show the actual envelope path and authentication verdicts.
- Use message trace or audit logs to find all recipients, not just the reporter. Search by sender, subject, URL, attachment hash, and network message ID.
- Preserve evidence before deleting. Export the message, headers, and audit records; then purge from mailboxes if policy allows.
- Containment for BEC includes password reset, session and token revocation, removing inbox rules and forwarding, blocking sender/domain/URL, and checking for mailbox delegation.
Worked example
A user reports an invoice email. Trace shows 12 recipients, one reply-to address on a lookalike domain, and an inbox rule hiding replies. The message passed SPF because it came from a compromised legitimate account. Response: preserve the message, remove the rule, reset the compromised account, revoke sessions, block the lookalike domain, purge the message from all 12 mailboxes, and review sign-in logs for the compromised account.
Traps
- Deleting the reported message before exporting headers.
- Trusting the displayed From instead of Return-Path and Authentication-Results.
- Searching only the reporter's mailbox.
- Resetting a password without revoking tokens or removing forwarding rules.