Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
Security Artifacts
about 1.5 hours of work
Constructed scenario. This case is written for practice. The organisation, the people and the events in it are invented, and no real incident is being described. The techniques, artifact locations and analytic reasoning are real, but the evidence is illustrative rather than exported from a live host, so it is tidier than anything you will meet in production.
Almost every host-based lab on this site assumes there is a disk to image. A
growing share of real incidents have no disk at all: the account is the asset,
the evidence is an audit log with a thirty-day life, and by the time anyone
notices, the interesting records are one week from rolling.
This one is entirely cloud. Ninety minutes if you work the questions properly.
The scenario is invented; the log schemas, the operation names and the technique
sequence are not.
The call
Halvorsen Marine, a 90-person shipping agency in Aberdeen. On Tuesday their
finance controller, Ingrid Sand, tells IT that a supplier has queried a change of
bank details she did not send. IT check her mailbox, find an inbox rule she does
not recognise, delete it, reset her password, and enable MFA on her account.
They call you on Thursday because it happened again, from a different mailbox.
What you have
What is in this lab
Questions
5
Artifacts
4
Staged hints
9
Sections
The call
What you have
Part one: the obvious finding
Part two: the sign-in that was not the compromise
Part three: what the rule was covering for
Part four: scope
Part five: write the remediation
What this lab is really about
The first question, as it appears
The rule IT deleted moved messages containing "invoice", "bank" or "payment" to
RSS Feeds and marked them read. Why RSS Feeds specifically, and what does the
choice tell you about the operator?
Its hints are staged from a nudge, to the method, to the answer. Members see all three.
[!] members only
The rest of this teardown: the full timeline, the complete IOC list and the detection rule with its tuning notes, is for members. Sign in if you have an account, or start a 7-day trial. No card is charged and none is collected up front.
