<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 - see LICENSE file for details. -->
---
name: performing-email-compromise-investigation
description: >-
  Investigate business email compromise incidents including header forensics, authentication log analysis, and lateral movement detection.
domain: cybersecurity
subdomain: incident-response
tags:
  - incident-response
  - performing-email-compromise-investigation
version: "1.0"
author: defconxt
license: AGPL-3.0
---

# Performing Email Compromise Investigation

## Overview

Investigate business email compromise incidents including header forensics, authentication log analysis, and lateral movement detection.

## Verification

- [ ] Procedure documented
- [ ] Tools identified
- [ ] Evidence collected
