Seven ways to spot a business email compromise in Office 365

This report explains Business Email Compromise (BEC): common scam categories (CEO impersonation, full account takeover, false invoice schemes), the frequent O365 techniques attackers use (malicious inbox rules, automatic forwarding/deletion, mailbox delegation, and VPN-based conditional-access bypass), and concrete detection/response guidance including sample logs, Sumo Logic queries, investigative playbooks, and recommended controls such as enabling mailbox auditing and integrating O365 logs with a SIEM.