Business Email Compromise Investigation
Runs on escalations where a mailbox may be in an attacker's hands — from inbox-rule-abuse triage, an account-takeover flow, or a reported fraudulent message. Triage established the account or a message looked wrong; investigation establishes whether the mailbox was truly controlled, what the actor did with it, and whether money or trust was redirected. The question is not "was the account suspicious" — it was — but "did an actor operate the mailbox, and what did they send, redirect, or read."
Inputs
- The escalated alert (mailbox, suspicious sign-in or rule or reported message, timing) and the triage report.
- Mailbox audit logs (sign-in, message send/read, rule and delegate changes), message-trace across the tenant, the sign-in logs for the owner, and the sent-items and rule state for the mailbox.
Investigation steps
Collect all four signals; the verdict is derived from them at the end.
1. Access confirmation — signal A
Confirm the mailbox was accessed by someone other than the owner. Signal A fires on a sign-in or mailbox access from infrastructure the owner never uses (new ASN/country/client), a token replay, or non-owner access that triage flagged — establishing control, not just a suspicious message. Fix the window of attacker control from first to last anomalous access.
2. Thread hijack and outbound fraud — signal B
Read what was sent from the mailbox during the control window. Signal B fires when the actor replied within existing threads (thread hijacking to borrow trust), sent invoice/payment/wire-change requests, or messaged finance, vendors, or customers with redirect instructions. Capture recipients (internal and external) and any changed bank/payment details — this is the fraud core of BEC.
3. Persistence and concealment — signal C
Audit what the actor left to keep access and stay hidden. Signal C fires
on inbox rules that forward or delete replies (see inbox-rule-abuse-triage),
added delegates or forwarding, a new MFA method (see
suspicious-mfa-enrollment-triage), or OAuth grants — the machinery that
keeps the fraud running and buries the evidence from the real owner.
4. Recipient and reach scoping — signal D
Scope who was touched: everyone the fraudulent mail reached, whether any recipient acted (replied, paid, changed details), and whether the actor pivoted to other internal mailboxes with the harvested trust. Signal D fires when the reach extends beyond the one mailbox — recipients who acted, or lateral spread to colleagues — setting the true incident scope.
Verdict rule
- malicious: signal A plus B or C — confirmed non-owner control with outbound fraud or attacker persistence. Any confirmed payment redirect or a recipient who acted on it (in D) is a high-severity malicious incident on its own.
- suspicious: access anomalies (A) or fraud-shaped mail (B) where control can't be fully confirmed and no benign explanation fits either.
- inconclusive: mailbox audit or message-trace logs are missing, so access, outbound mail, or reach can't be reconstructed.
- benign: the activity resolves to the legitimate owner — a sign-in and the messages both match their baseline and role, a rule or delegate they set themselves, no fraud-shaped outbound mail, no attacker persistence. A misjudged-but-legitimate account.
Output
Verdict
One of malicious / suspicious / inconclusive / benign, with the
signals that decided it, and an explicit recipient/impact scope.
Recommended actions
When not benign: reset the owner's password and revoke all sessions/tokens, remove attacker rules/delegates/forwarding and rogue MFA methods, purge fraudulent messages tenant-wide, and — critically for BEC — notify finance and every recipient of a payment-redirect request to halt or claw back transfers, and alert affected vendors/customers. Escalate to fraud/legal when money moved. Scope to the reach found in step 4.
Evidence
The attacker-control window and access attribution, the fraudulent messages sent with recipients and any changed payment details, the persistence mechanisms left behind, and the full internal/external reach with any recipients who acted.
Reasoning
Name the signals and how they stacked — a mailbox accessed from a foreign VPS, replying inside a live invoice thread with new bank details to a customer who then paid, plus a rule deleting the customer's replies, is a high-severity malicious BEC scoped to that customer and thread; an owner sending normal mail from their usual device with a self-made vacation rule is benign.
