Business Email Compromise (BEC) Investigation | IR Playbook

A CFO just wired $500k to attackers — and the email looked perfect.

IR Playbook | DFIR Media

• Business email compromise starts with one stolen password.
• Check Azure AD sign-in logs for impossible travel or suspicious IPs.
• Pull mailbox audit logs — look for MailItemsAccessed and SendAs events.
• Attackers create forwarding rules to exfiltrate emails to external addresses.
• Check for malicious OAuth apps — attackers grant themselves persistent access.
• Containment: reset password, revoke sessions, delete inbox rules, remove OAuth apps.
• Alert business partners immediately — wire fraud happens fast.

AI-generated narration | DFIR Media

Видео Business Email Compromise (BEC) Investigation | IR Playbook канала DFIR Lab