Anatomy of a business email compromise investigation

Look beyond the first alert

My original May article examined a business email compromise investigation that began with a phishing alert. This edition removes customer names, provider promotion, and testimonials so the focus stays on the investigative lessons. It does not present the response as a service delivered by Nexlinks.

The important shift was from a single credential-exposure event to a pattern of persistent mailbox access around financial communications. That changed the business risk and the scope of the investigation. Closing the phishing alert without examining what the identity did afterward would have left the more consequential question unanswered.

Mailbox behavior changed the assessment

The account described in the original case included rules that intercepted banking-related messages and moved them into folders users were less likely to review. Similar rule logic across finance-adjacent mailboxes, together with unusual sign-in activity, justified a broader investigation.

An unusual location or time is a lead, not proof on its own. Compare those signals with the user’s normal activity, mailbox changes, message handling, and the timing of business processes. The strongest assessment comes from the pattern across the evidence, rather than a dramatic interpretation of one sign-in.

Contain access and remove persistence

Containment should address both the compromised identity and the ways an attacker may retain access. Microsoft’s response guidance covers disabling the affected account during investigation, revoking sessions, reviewing authentication methods and application consent, and checking roles and mail forwarding. Suspicious inbox rules, delegations, and other mailbox changes also need review.

Preserve relevant evidence while acting quickly to limit harm. Record what was found, what was changed, and when each action occurred. A password reset alone is an incomplete response if unauthorized access methods or mailbox persistence remain in place.

Supporting reference: Respond to a compromised email account in Microsoft 365 - Microsoft Defender for Office 365 ↗

Reconstruct the period of access

Use available Entra sign-in records, mailbox and audit activity, Defender telemetry, and Sentinel analytics to establish the timeline. Determine which accounts were involved, which messages or data may have been accessed, and whether the attacker attempted to alter a financial workflow. Retention and licensing affect the available evidence, so distinguish a confirmed absence of activity from a period for which records are missing.

Finance and executive stakeholders need a clear explanation of the exposure and a trusted channel for validating payment instructions. Security containment and business verification should move together. A technically contained account does not answer whether an attacker’s earlier message is still influencing a payment decision.

Turn the investigation into a better control

After containment, revisit the specific behaviors that made the incident possible. Improve monitoring for suspicious mailbox rules and delegation changes, review Conditional Access for sensitive roles, and ensure the response team can reach the business owners quickly. Test a scenario in which an apparently routine phishing alert leads to a finance-mailbox investigation.

The lesson I take from this case is the value of shared context. Defender and identity logs supply signals, but a coordinated investigation connects those signals to a business consequence. Assign responsibility for that connection before the next incident forces the question.