BEC Response: What to Do in the First Hour (Microsoft 365)
The first hour after a Microsoft 365 business email compromise: stop the money, keep the logs, revoke sessions and remove persistence, in the right order.
Series
Responding to a Microsoft 365 BEC
2 posts in this series. Read them in order or jump to any one.
- BEC Response: What to Do in the First Hour (Microsoft 365)
The first hour after a Microsoft 365 business email compromise: stop the money, keep the logs, revoke sessions and remove persistence, in the right order.
- BEC Example: A Fictional Microsoft 365 Incident Walkthrough
A fictional AiTM business email compromise rebuilt from its Microsoft 365 logs: spray, token replay, inbox rules, forwarding, OAuth consent, fake invoice.
All posts in this series
BEC Example: A Fictional Microsoft 365 Incident Walkthrough
A fictional AiTM business email compromise rebuilt from its Microsoft 365 logs: spray, token replay, inbox rules, forwarding, OAuth consent, fake invoice.