<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-email-compromise-investigation
description: >-
  Investigate business email compromise incidents including header forensics, authentication log analysis, and lateral movement detection.
domain: cybersecurity
subdomain: incident-response
tags:
  - bec
  - email-forensics
  - header-analysis
  - oauth-abuse
  - lateral-movement
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566", "T1078", "T1114", "T1534"]
---

# Performing Email Compromise Investigation

## Overview

Business Email Compromise (BEC) investigations require correlating email header forensics, OAuth token abuse, authentication logs, and inbox rule changes to reconstruct attacker access, exfiltration scope, and lateral movement paths. Speed matters — attackers often complete financial fraud within hours of initial access.

Mode: `[MODE: INCIDENT]` — Triage mindset. Establish timeline first. Contain.

## ATT&CK Mapping

| Technique | ID | Indicator |
|---|---|---|
| Phishing for credentials | T1566.002 | Spear-phishing link in email headers |
| Valid accounts | T1078.004 | Successful auth from anomalous IP/ASN |
| Email collection | T1114.002 | Mail forwarding rules, large folder reads |
| Internal spearphishing | T1534 | Lateral mail from compromised account |
| OAuth application abuse | T1528 | Third-party app granted mail.read scope |

## Triage Sequence

1. Preserve volatile state — export mailbox rules and delegations before remediation
2. Pull authentication logs (Azure AD sign-in / Google Workspace) for affected account
3. Identify first anomalous login: timestamp, IP, user-agent, MFA bypass method
4. Check OAuth app grants — look for suspicious apps with mail.read/mail.send
5. Enumerate inbox rules created after compromise timestamp
6. Search sent items and deleted items for unauthorized messages
7. Identify recipients of impersonation or financial redirection emails
8. Check mail forwarding to external addresses
9. Search for BCC rules silently copying outbound mail
10. Determine if lateral movement occurred to other accounts

## Header Forensics Fields

| Field | What to Check |
|---|---|
| `Received` chain | IP hops — look for unexpected relay or SaaS origin |
| `Authentication-Results` | SPF/DKIM/DMARC pass/fail status |
| `X-Originating-IP` | Sender's actual IP if present |
| `Message-ID` | Format anomalies indicating spoofing or BEC kit |
| `Reply-To` | Mismatch with `From` — redirect for financial fraud |
| `X-Mailer` / `User-Agent` | Tool fingerprint (Outlook vs webmail vs API) |

## Authentication Log Indicators

| Signal | Description | Query Pattern |
|---|---|---|
| Impossible travel | Login from two geographically distant IPs within short window | `timestamp diff < 1h AND distance > 500km` |
| Legacy auth | Basic auth or IMAP bypassing MFA | `clientAppUsed in ("IMAP", "POP3", "SMTP Auth")` |
| Token replay | Same refresh token used from different IP | `tokenIssuedAt matches AND IP differs` |
| New device fingerprint | Login from previously unseen device ID | `deviceId NOT IN (baseline_30d)` |
| Off-hours access | Access at unusual hour for user's timezone | `hour NOT IN (user_normal_hours)` |

## Containment Actions

- Revoke all active sessions and OAuth tokens for compromised account
- Disable mailbox forwarding and delete malicious inbox rules
- Reset credentials and enforce MFA re-registration
- Block external IP addresses observed in authentication logs
- Notify affected external recipients if financial fraud in scope
- Preserve evidence before remediation (export logs, take snapshots)

## Evidence Preservation

| Artifact | Location | Retention |
|---|---|---|
| Sign-in logs | Azure AD / Google Workspace admin | 30–90 days depending on license |
| Mail trace logs | Exchange Online / Google Vault | 90 days (EXO), configurable (Vault) |
| Inbox rules export | `Get-InboxRule` / Gmail API | Snapshot immediately on detection |
| Audit log export | Purview / Google Vault | Export to SIEM before expiry |
| Header exports | `.eml` files with full headers | Preserve originals for forensic use |

## Related Techniques

- [Performing Threat Actor Attribution](../performing-threat-actor-attribution/SKILL.md)
- [Performing Cloud Forensics Investigation](../../../cloud-forensics/techniques/investigating-aws-cloudtrail-logs/SKILL.md)
