Business Email Compromise (BEC) Triage & Remediation Guide
Remediating hijacked executive inboxes, purging covert forwarding rules, revoking rogue OAuth cloud apps, and hardening Microsoft 365 tenants.
⚡ Direct Answer & Quick Diagnostic Summary (AEO)
When an executive or finance email account is compromised in Microsoft 365, follow this immediate triage workflow: First, revoke all active user refresh tokens and session cookies via Microsoft Entra Admin Center (Revoke sessions) and reset the account password with a 20+ character passphrase. In Exchange Online PowerShell (Connect-ExchangeOnline), inspect and purge malicious inbox forwarding and transport rules using Get-InboxRule -Mailbox <User> - attackers routinely create covert rules that forward invoices to external Gmail addresses and move incoming emails from banks to the RSS Subscriptions or Deleted Items folder. Audit Enterprise Applications in Entra ID to detect and revoke illicit OAuth consent grants (App-only permissions) that allow persistent mailbox access even after password resets. Check Mailbox Delegation for unauthorized FullAccess or SendAs rights. Finally, enforce Number Matching MFA, block legacy basic authentication protocols (POP3, IMAP, SMTP AUTH), and configure Conditional Access policies restricting logins strictly to Pakistani IP ranges or compliant company devices.
Primary Root Causes
Can't resolve this issue or hardware failure halted your shift?
Our certified field hardware & network engineers are on standby for emergency on-site repair across Korangi, SITE, Clifton, DHA, Shahrah-e-Faisal, and all Karachi commercial areas.
Step-by-Step Diagnostic Checklist
Step 1: Revoke Active Cloud Sessions & Force Immediate Password Reset
In Microsoft Entra Admin Center (entra.microsoft.com), search for the compromised user, click "Revoke sessions" to kill all active browser sessions, mobile tokens, and Outlook desktop logins. Next, reset the password and require password change on next login.
Step 2: Inspect & Purge Malicious Inbox Forwarding Rules
Connect via Exchange Online PowerShell (Connect-ExchangeOnline) and run: Get-InboxRule -Mailbox user@company.com | Select Name, Description, ForwardTo, DeleteMessage, MoveToFolder. Attackers hide rules named "." or "AutoClean" that silently delete emails containing words like "invoice", "bank", or "wire". Delete malicious rules using Remove-InboxRule.
Step 3: Audit & Revoke External Mailbox Forwarding
Run Get-Mailbox -Identity user@company.com | Select ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForward. If an unauthorized forwarding address is present, clear it immediately with Set-Mailbox -Identity user@company.com -ForwardingSmtpAddress $null.
Step 4: Detect & Terminate Rogue OAuth Enterprise Applications
Attackers increasingly maintain persistent access using OAuth tokens rather than passwords. In Entra ID, navigate to Enterprise Applications and review recently consented apps. Look for high-risk permissions such as Mail.ReadWrite, Mail.Send, and full Mailbox.Read. Revoke any app consent granted without IT authorization.
Step 5: Audit Mailbox Delegation & Send-As Permissions
Verify whether attackers granted themselves permanent backdoor delegation. Run Get-MailboxPermission -Identity user@company.com | Where-Object {$_.User -notlike "NT AUTHORITY*"} and Get-RecipientPermission -Identity user@company.com to verify no unauthorized third-party accounts possess FullAccess or SendAs privileges.
Step 6: Enforce FIDO2 / Authenticator Number Matching & Block Legacy Auth
Upgrade tenant security defaults or Conditional Access policies. Require Microsoft Authenticator with Number Matching or FIDO2 hardware passkeys, and disable legacy authentication protocols (IMAP4, POP3, Authenticated SMTP) across all mailboxes to block automated brute-forcing.
Frequently Asked Questions
Why did changing the executive email password fail to stop the attacker from reading emails in Karachi?
Modern threat actors use illicit OAuth application consent. When the user clicked a fake document link, they authorized a third-party app with Mail.Read permissions. This app uses cloud API tokens to read emails directly from Microsoft Graph API, completely bypassing user password changes until the OAuth application is deleted from Entra ID.
How do attackers hide emails from the victim while replying to clients in a BEC attack?
Attackers create an inbox rule that automatically routes incoming emails from specific vendors or clients into the "RSS Feeds", "Conversation History", or "Archive" folders, marking them as read. The victim never sees incoming client questions while the attacker sends forged bank account details.
Need Enterprise Deployment or Support for Cybersecurity Company & Services?
If your team needs full hands-on setup, SLA monitoring, or emergency on-site assistance in Karachi, our certified engineers are ready.