Research

Guided lab: the mailbox rule that was not the point

A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.

Full write-up available to members subscribers. See what is included.