Tools · Incident response playbooks · 12 / 20
Playbook: business email compromise and mailbox takeover response
Respond to a compromised mailbox used for payment fraud: contain the account, find malicious inbox rules and OAuth apps, scope what was read or sent, and work with finance on recovery.
How it shows up
Typical signs: a vendor reports a changed bank account request from your employee, a user notices replies they did not send, or an alert flags a new inbox rule that moves messages from finance contacts to an obscure folder. Attackers often sign in with stolen credentials or tokens, set up forwarding or hiding rules, and then send convincing payment requests in existing threads.
Contain
Reset the password, revoke sessions and refresh tokens, and confirm MFA methods belong to the user. Remove suspicious inbox rules and forwarding, and review OAuth app consents for apps with mail permissions. Block the attacker’s sign-in IPs if useful.
# Exchange Online PowerShell (lab tenant) Get-InboxRule -Mailbox j.doe@contoso.example | Format-List Name,Enabled,From,SubjectContainsWords,MoveToFolder,ForwardTo,RedirectTo,DeleteMessage Get-Mailbox j.doe@contoso.example | Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward Revoke-MgUserSignInSession -UserId j.doe@contoso.example Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-14) -EndDate (Get-Date) -UserIds j.doe@contoso.example -Operations New-InboxRule,Set-InboxRule,MailItemsAccessed,Send -ResultSize 500
Lab: hunt in a test tenant
In a Microsoft 365 developer tenant, sign in as a test user, create an inbox rule that moves messages containing “invoice” to RSS Feeds and marks them read, and set external forwarding. Then, as an administrator, find both with the commands above and in the audit log, remove them, revoke sessions, and write the timeline. Note what information the audit log gives about the client IP and app.
Scope and recover
Determine which messages were read and sent during the compromise window using MailItemsAccessed and Send audit events where available. Contact finance immediately if any payment may have been diverted; banks can sometimes recall transfers if notified fast. Notify affected external contacts, and assess whether personal data exposure triggers notification duties with legal.
Diagram
BEC artifacts to check
Attackers hide in plain sight.
- Inbox rules
Move, delete, or mark read messages from finance or vendors.
- Forwarding
Mailbox-level or rule-based forwarding to external addresses.
- OAuth consents
Apps granted Mail.Read or Mail.Send.
- MFA methods
New phone or authenticator registered by the attacker.
- Sent items
Payment change requests in existing threads.
Check yourself
1. An inbox rule moves all messages from a vendor to RSS Feeds and marks them read. What is it likely for?
2. Which step prevents an attacker’s existing tokens from continuing to work?
3. A payment may have gone to the attacker’s account. What is most urgent?