Business Email Compromise and Microsoft 365 Investigation

Part of Incident Response Services

A fraudulent wire often starts with one mailbox rule. We investigate Microsoft 365 and Exchange compromises, contain the threat actor, and give you a timeline you can use with your bank, insurer and counsel.

Signs an account may be compromised

Vendors or customers report unusual invoices or changed payment instructions
Inbox rules nobody created: auto-delete, auto-forward, or moving messages to obscure folders
Sign-ins from unfamiliar locations or impossible-travel alerts
Users locked out, or MFA prompts they did not initiate
Sent items containing messages your team did not write

What we investigate

Unified Audit Log and sign-in logs: who signed in, from where, and what they did.
Inbox rules, forwarding and delegations: the persistence that hides fraud.
OAuth app grants and token abuse: access that survives a password reset.
Message trace and mail flow: what was read, sent and diverted.
Multiple tenants: we work across client Microsoft 365 tenants and can connect to yours through a one-time administrator approval.

How it works

Assess. Identify which identities, mailboxes and data are involved.
Contain. Revoke sessions and app grants, reset credentials, enforce MFA, and remove threat actor persistence.
Investigate. Reconstruct the timeline from audit and mail-flow evidence.
Recover. Restore safe mail flow and document the impact for insurers, banks and counsel.
Harden. Conditional access, alerting and email threat protection tuned to what we found.

What you receive

A forensic timeline of what the threat actor read, sent and changed
Verified containment and eviction, not just a password reset
A plain-English executive report suitable for insurance and legal review
A Microsoft 365 hardening baseline: MFA, conditional access, audit logging and alerting
Optional ongoing coverage under CMDR

Before an incident

To find weak spots before someone else does, ask about a proactive Microsoft 365 security review covering audit logging, conditional access, legacy authentication, app consent policies and admin separation.

Talk to an incident responder

Book a free 30-minute incident response call, or call our 24/7 staffed hotline at 231-350-3171. Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day.