ZEKASTRA case pack VP-07 - Business e-mail compromise in Microsoft 365 - SYNTHETIC TRAINING DATA
The organisation, people, accounts, messages, bank details and times are invented. Domains end in .example (RFC 2606), IP addresses are from documentation ranges (RFC 5737, RFC 3849), autonomous system numbers are from the documentation range (RFC 5398), and the IBAN has invalid check digits on purpose.

Scenario (EN)
Akyel Tekstil A.S. uses Microsoft 365. Its collections officer s.kaya handles customer payments. On Monday 13 July 2026 the customer Delta Perakende A.S. said it had paid invoice 2026-0715 on 9 July to the "new bank account" Akyel had sent. Akyel has no new account. The company asks: how was the mailbox reached, what was read and taken, who else received the message, what hid the customers' replies, and when the money left the customer.

Senaryo (TR)
Akyel Tekstil A.Ş. Microsoft 365 kullanır. Tahsilat sorumlusu s.kaya müşteri ödemelerini yürütür. 13 Temmuz 2026 Pazartesi günü müşteri Delta Perakende A.Ş., 2026-0715 numaralı faturayı 9 Temmuz'da Akyel'in gönderdiği "yeni banka hesabına" ödediğini bildirdi. Akyel'in yeni bir hesabı yok. Şirket soruyor: posta kutusuna nasıl ulaşıldı, ne okundu ve ne alındı, iletiyi başka kim aldı, müşterilerin cevaplarını ne gizledi ve para müşteriden ne zaman çıktı?

Files
ual-export.csv          Microsoft Purview unified audit log export, all users, UTC.
entra-signins.csv       Microsoft Entra sign-in logs, interactive and non-interactive, UTC.
message-trace.csv       Exchange Online message trace, UTC.
iban-degisikligi.eml    The message as the customer received it. Some headers are in the customer's local time.
odeme-dekontu.txt       The customer's bank receipt. LOCAL time UTC+3.
export-metadata.txt     Window, time basis and scope of every export. Read it first.
acquisition-log.txt     What was collected, when and how.
manifest.txt            SHA-256 of every file above.

Rules
1. Verify every file against manifest.txt before you read anything else.
2. Write the time basis next to every time you copy out. Convert to UTC before you compare two sources.
3. An audit record is not a message: count messages by InternetMessageId, not rows.
4. A passed DKIM check says which domain signed the message, not who was at the keyboard.