Business Email Compromise (BEC) & Phishing Investigations in Office365
Demonstrates business Email Compromise (BEC) & Phishing Investigations in Office365 and evaluates key implications for security practitioners.
Summary
Overview: Justin Safa of Optiv presents at Source Zero Con on investigating business email compromise and phishing incidents in Microsoft 365 environments.
Key Topics: Phishing as persistent initial access vector; MFA bypass via adversary-in-the-middle and device code phishing; OAuth app persistence; attacker-registered MFA devices; and cross-tenant lateral movement.
Technical Details: Safa covers modern BEC investigation workflows including identifying attacker-enrolled MFA devices, OAuth application persistence mechanisms, and lateral movement between M365 tenants into on-premises systems via compromised credentials.
Takeaways: M365 BEC investigations require checking MFA device registrations and OAuth grants, not just mailbox rules. Attackers have evolved beyond simple credential harvesting to persistent cloud access techniques.
Related talks
Source Zero Con·48 min
Evaluates catch a Vish and evaluates key implications for security practitioners.
Source Zero Con·33 min
Presents source Zero Con: Leveling Up Your Phishing Game On Modern Platforms and evaluates key implications for security practitioners.
Source Zero Con·47 min
Outlines source Zero Con: Analyzing Phishing Documents 101 with HTB and evaluates key implications for security practitioners.