Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to oauth.

Collection

Format

Guided LabMembersConstructed

Guided lab: the mailbox rule that was not the point

A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.

1 Sept 2026about 1.5 hours of workT1566.002T1078.004T1114.003lab cloud m365 bec

Full write-up available to members subscribers. See what is included.