Business e-mail compromise in Microsoft 365: a relayed sign-in, a hidden rule and a changed bank account

01Brief

Akyel Tekstil A.S. uses Microsoft 365 (E5, Audit Premium). Its collections officer s.kaya handles customer payments. On Monday 13 July 2026 the customer Delta Perakende A.S. said it had paid invoice 2026-0715 on 9 July to the new bank account Akyel had written about. Akyel has no new account. Delta forwarded the message and its bank receipt; an examiner revoked the user's sessions and exported the audit log, the sign-in logs and the message trace for 6 to 9 July. The receipt and the headers the customer's servers added are in local time.

Internal audit asks:

1. How was the mailbox reached when the account had MFA, and is any other account exposed?
2. What was read, taken and changed in the mailbox, and what hid the customers' replies?
3. Who received the bank change message, from where was it sent, and when did the money leave the customer?

Answer from the files only. Name accounts, addresses, messages and files; do not name a person as the sender of the fraudulent message or name a criminal group. The phishing page and the hosts behind the two outside addresses were not examined: say what the tenant's records show about them and stop there.

02Evidence files

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

You can also examine these files on the examination workbench: hashes, one UTC timeline, sessions and a findings draft in the browser.

03Before you start

• Verify every file against manifest.txt and write the result in your examination log before you read anything else.
• Write the time basis next to every time you copy out. The cloud exports are UTC; the receipt and the customer's Received headers are local time.
• Count messages by InternetMessageId, not audit rows. Write the filter you used next to every number.
• An account and an address are not a person. Say which session did something, not who sat at the keyboard.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 16 questions, 28 points.

1. Q011 pointual-export.csvmanifest.txt

   On a copy of ual-export.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first 8 hex characters.8 hex characters
   Check

2. Q022 pointsentra-signins.csvmessage-trace.csv

   After the phishing message arrived, when did s.kaya first sign in successfully from an address outside the office range 192.0.2.0/24? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

3. Q032 pointsentra-signins.csvmessage-trace.csv

   The phishing message reached three mailboxes. How many of those accounts signed in successfully from the same address as s.kaya's relayed sign-in?A whole number
   Check

4. Q042 pointsentra-signins.csv

   At 06:44:18 s.kaya signs in from 203.0.113.77 with 'MFA requirement satisfied by claim in the token' and no password failure before it. What does this show?

   AThe user approved a second MFA prompt from Frankfurt, so the user was travelling.BNo prompt was shown: the session presented a token that already carried the MFA claim, which fits a session issued through the proxy 13 minutes earlier being used from another address.CMFA was switched off for the account, so any address could sign in.DThe password was guessed in the password spray of the same night.
   Check

5. Q051 pointual-export.csventra-signins.csv

   From which address was the mailbox read through Outlook on the web after the replayed sign-in?An IPv4 address
   Check

6. Q062 pointsual-export.csv

   How many distinct messages did 203.0.113.77 open (MailAccessType Bind) in the window?A whole number
   Check

7. Q072 pointsual-export.csvexport-metadata.txt

   s.kaya's mailbox also has MailItemsAccessed Sync records every hour from 192.0.2.10. What do they show?

   AThat the attacker downloaded the whole mailbox, because Sync means a full copy.BWhich messages the user read each hour.CThat the user's desktop Outlook synchronised a folder from the office address; a Sync record names the folder, not the messages, and none comes from 203.0.113.77, whose client recorded binds.DThat the inbox rule was running, because rules synchronise folders.
   Check

8. Q082 pointsual-export.csv

   When was the inbox rule created? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

9. Q091 pointual-export.csv

   Into which folder did the rule move the messages it matched?A folder name
   Check

10. Q101 pointual-export.csv

    Which file did 203.0.113.77 download from s.kaya's OneDrive?A file name
    Check

11. Q112 pointsual-export.csviban-degisikligi.emlmessage-trace.csv

    When was the message the customer received sent from s.kaya's mailbox? UTC.YYYY-MM-DD HH:MM:SS, UTC
    Check

12. Q122 pointsiban-degisikligi.eml

    The customer's server records spf=pass, dkim=pass and dmarc=pass for akyeltekstil.example. What does that establish?

    AThat s.kaya wrote and sent the message.BThat the message was sent through Akyel's own Microsoft 365 tenant and signed for its domain, so it is not a spoofed lookalike; it says nothing about who controlled the session.CThat the message is genuine and the bank details are correct.DNothing, because authentication results can always be forged.
    Check

13. Q132 pointsual-export.csvmessage-trace.csv

    How many distinct messages were sent from s.kaya's mailbox by 203.0.113.77?A whole number
    Check

14. Q142 pointsual-export.csvmessage-trace.csv

    Delta Perakende replied to the message. When was that reply opened, and from where? Give the time in UTC.YYYY-MM-DD HH:MM:SS, UTC
    Check

15. Q152 pointsodeme-dekontu.txtexport-metadata.txt

    When did the transfer leave Delta Perakende? UTC.YYYY-MM-DD HH:MM:SS, UTC
    Check

16. Q162 pointsual-export.csventra-signins.csvmessage-trace.csviban-degisikligi.emlodeme-dekontu.txt

    Which sentence could the examiner sign from these files alone?

    As.kaya sent the customers a new IBAN and deleted the messages to hide it.BThe account had no MFA, so the password spray of 6 to 9 July gave access to the mailbox.CAfter a phishing message delivered at 06:12 UTC on 7 July, s.kaya's sign-in was relayed through 198.51.100.23 with the MFA prompt approved; from 06:44 UTC a session for the account was used from 203.0.113.77 with the MFA claim carried in the token. That session read 12 messages, downloaded the customer ledger, created the rule '..' moving payment replies to RSS Akışları, sent the bank change message to three customers on 8 July and deleted the copies. Delta Perakende's transfer left at 08:20 UTC on 9 July. b.aslan's sign-in was relayed through the same address.DBecause the messages were deleted, it cannot be shown who received them.
    Check

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

• Every time carries its basis; the receipt and the customer's headers are converted from local time.
• Messages are counted by InternetMessageId, and the report says why rows and OperationCount differ.
• The relayed sign-in and the replayed session are described separately, and 'MFA satisfied by claim' is not reported as a user approval.
• Acts are attributed to a session and an address, not to the user.
• The report names the two other customers and the second relayed account, and asks for their follow-up.

How findings are phrased →