Microsoft 365 BEC: Malicious Inbox Rules
An adversary-in-the-middle phishing kit steals an AP manager's Microsoft 365 session token, bypassing MFA. The actor creates hidden inbox rules to collect mail and suppress replies, then hijacks a live vendor payment thread to redirect a six-figure wire transfer. Work the Entra sign-in audit, Exchange Online rule events, and email evidence to reconstruct the chain.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the hijacked identity
20The Accounts Payable function is the target. One cloud account was used from an external IP that the tenant does not recognize. Identify it.
Trace the initial access point
20The actor's first foothold in the cloud environment came from a specific IP. A cluster of failed attempts immediately preceded the successful session from that same address.
Find where the mail is going
25Within minutes of gaining access, the actor set up persistent collection. Identify the external address all inbound mail was being forwarded to.
Uncover the cover-up rule
20A second inbox rule was created to suppress detection. Identify it by name.
Identify the phishing portal
20The credential theft originated from a lookalike domain. Identify it from the email evidence.
Classify the persistence mechanism
15Map the inbox rule tactic to its MITRE ATT&CK technique.
Recover the fraudulent account details
20The actor's end goal was financial fraud. Identify the IBAN the attacker inserted into the payment thread.
7 tasks · 140 points total
Training Tools
Cloud Console
Cloud infrastructure logs
Email Console
Email header & content analysis
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with Email concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allGCP Service Account Key Abuse: IAM Privilege Escalation
A developer committed a GCP service account JSON key to a public repository and an attacker found it within hours. Work the GCP Cloud Audit Logs to trace how the leaked credential was turned into a full IAM privilege escalation and a bulk download of the production secrets vault.
Exposed Kubernetes API: Cryptojacking the Cluster
Three EKS worker nodes started pegging their CPUs overnight. The Kubernetes API server was reachable from the internet with anonymous access enabled, and an automated attacker used it to deploy a privileged DaemonSet on every node, escape the container to the host, drop a Monero miner, and steal the node IAM credentials. Work the cluster audit log, host records, perimeter egress, and CloudTrail to reconstruct the full intrusion chain.
AWS S3 Ransomware: SSE-C Encryption (Codefinger)
Client deliverables and backups at a professional-services firm are silently re-encrypted overnight using a legitimate AWS storage feature. No malware runs on any host. Working through CloudTrail, piece together how stolen service-account keys were used to install a countdown clock and lock every object behind a key only the attacker holds.