Skip to Main Content

Business Email Compromise in Microsoft 365

Take swift action to contain and recover from email attacks.

Email drives modern business communication, but the rising threat of business email compromise (BEC) by cybercriminals jeopardizes data security and integrity.

In today's digital age, collaborative environments have become the lifeblood of business communication, and Microsoft 365 (M365) is at the forefront of this transformation. However, this digital transformation comes with a growing threat - BEC. Cybercriminals and threat actors are constantly looking for ways to compromise sensitive information, commit fraud, and steal valuable data.

TrustedSec’s BEC offering provides a low-cost way for companies to quickly determine what actions attackers took within their M365 environment after they were compromised. Analysis will include examining M365 user activities for:

  • Attacker Sign-Ins
  • Evidence of files accessed or downloaded
  • Emails sent by attackers
  • Unauthorized MFA devices
  • Malicious mailbox rules

Additionally, TrustedSec searches the M365 tenant for other users that may have been compromised so the organization can be assured if their compromise has been contained.

BECs require swift action by organizations to contain and recover from an attack. TrustedSec’s BEC analysis lets every organization quickly respond to the attack, determine what actions were taken by attackers, and be confident that the compromise is resolved.

“TrustedSec allows me to help make an impact on our clients and help those in need.”
Tyler HudakPractice Lead, Incident Response

Learn more about our services from an expert.

Let our experts tailor solutions to your security challenges.

Read our blog

Explore the latest cybersecurity topics on the TrustedSec Security Blog

Blog February 22 2024

MailItemsAccessed Woes: M365 Investigation Challenges

Email compromises within Microsoft 365 are too common these days. The TrustedSec Incident Response team receives a lot of calls to investigate M365 email…

Read about this article
Blog February 01 2024

The Rising Threat: A Surge in Zero-Day Exploits

IntroductionThe cat-and-mouse game between defenders and attackers continues to escalate in the ever-evolving cybersecurity landscape. Advanced Persistent…

Read about this article
Blog December 14 2023

Unmasking Business Email Compromise: Safeguarding Organizations in the Digital Age

Business Email Compromises (BEC) within the Microsoft 365 environment are a large threat with nearly $500 Million reported in stolen funds in 2022[1].…

Read about this article
Blog July 25 2023

Prefetch: The Little Snitch That Tells on You

Incident Response and forensic analysts use the contents of prefetch files in investigations to gather information, such as the source from which an executable…

Read about this article
Blog June 01 2023

Critical Vulnerability in Progress MOVEit Transfer: Technical Analysis and Recommendations

On May 31, 2023, Progress Software released a security bulletin concerning a critical vulnerability within MOVEit Transfer, a widely used secure file transfer…

Read about this article
Blog April 25 2023

Incident Response Rapid Triage: A DFIR Warrior's Guide (Part 3 – Network Analysis and Tooling)

Within the first two installments of this series, we identified the key to successful incident preparation starts with making sure a solid incident triage…

Read about this article
Blog April 20 2023

Incident Response Rapid Triage: A DFIR Warrior's Guide (Part 2 – Incident Assessment and Windows Artifact Processing)

In Part 1 of this series, we identified that there are three (3) key parts to successful incident preparation: ensuring that a solid incident triage process is…

Read about this article
Blog April 18 2023

Incident Response Rapid Triage: A DFIR Warrior's Guide (Part 1 – Process Overview and Preparation)

In this series, I will be discussing how to handle an incident with the speed and precision of a DFIR warrior. With a rapid triage mindset, you'll be able to…

Read about this article
Blog April 11 2023

On the Road to Detection Engineering

Introduction People have asked numerous times on Twitter, LinkedIn, Discord, and Slack, “Leo, how do I get into Detection Engineering?” In this blog, I will…

Read about this article
Blog March 17 2023

Critical Outlook Vulnerability: In-Depth Technical Analysis and Recommendations (CVE-2023-23397)

Threat Overview Earlier this week, Microsoft released a patch for Outlook vulnerability CVE-2023-23397, which has been actively exploited for almost an entire…

Read about this article