Investigating BEC at two speeds

We recently supported two business email compromise (BEC) investigations in which attackers gained access to legitimate Microsoft 365 identities and went on to abuse trusted mailboxes. At a high level, the cases had quite a lot in common. The way they unfolded, however, was very different.

In the first investigation, suspicious access and malicious mailbox activity happened close together. In the second, we found a suspicious authentication event approximately seven days before the first confirmed mailbox abuse. We could not conclusively establish that the earlier login belonged to the same attack chain, but the subsequent compromise gave us a reason to examine it more closely.