Observations From Business Email Compromise (BEC) Attacks

This article provides investigative guidance for business email compromise (BEC) incidents, stressing the importance of log analysis, message-header and IOC extraction, inspection of mailbox inbox rules (and automated enumeration via PowerShell) to find message redirection/persistent collection, and review of MFA and OAuth registrations to detect bypass or persistence; it aims to help reduce attacker dwell time and improve detection and response.