01Session plan
| Minutes | Block | What happens |
|---|---|---|
| 0–15 | Brief, rules and integrity (Q01) | Read the scenario and export-metadata.txt together. Mark the two local-time sources: the receipt and the customer's Received headers. |
| 15–50 | The way in (Q02–Q05) | Lay the trace next to the sign-in log. Separate the relayed sign-in from the replayed session and read the MFA result column aloud. |
| 50–95 | Inside the mailbox (Q06–Q10) | Expand AuditData. Count messages, not records; compare Bind with Sync; find the rule and the download. |
| 95–130 | Out to the customers (Q11–Q15) | Tie the .eml to a Send record by Message-ID, count the sends, follow a reply into the rule's folder and convert the receipt. |
| 130–150 | The signed sentence (Q16) | Each trainee writes the finding and the actions it requires, then compares it with sentence c and the model finding. |
Materials: the pack files on each trainee's machine, a printed worksheet from the pack page, and an examination log form. Pack page →
02Answer key
Q011 point
On a copy of ual-export.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first 8 hex characters.
Answerca29b61b
The prefix matches the manifest line. A spreadsheet that opens the file may re-quote the AuditData column when it saves; hash before you filter.
- Where
- manifest.txt, the ual-export.csv line.
- Usual mistake
- Hashing the file after a spreadsheet has saved it again.
Hash calculatorF-04 Examination logSOP-02 Evidence intake and registration
Q022 points
After the phishing message arrived, when did s.kaya first sign in successfully from an address outside the office range 192.0.2.0/24? UTC.
Answer2026-07-07 06:31:05
The message trace shows the message 'Paylaşılan belge: 2026 Q3 Sipariş Formu' delivered at 06:12:40. At 06:30:51 the user's OfficeHome sign-in from 198.51.100.23 is interrupted with error 50074 (strong authentication required); at 06:31:05 it succeeds with 'MFA successfully completed'. The browser is the user's own Edge; the address is not the user's.
- Where
- message-trace.csv, the three rows with that subject; entra-signins.csv, s.kaya rows from 198.51.100.23.
- Usual mistake
- Giving 06:30:51, the interrupted attempt, or 06:44:18, the replay from another address.
Q032 points
The phishing message reached three mailboxes. How many of those accounts signed in successfully from the same address as s.kaya's relayed sign-in?
Answer2
Filter the successful sign-ins on 198.51.100.23: s.kaya at 06:31:05 and b.aslan at 06:52:17, both with the MFA prompt approved. m.demir did not sign in from it. b.aslan's session shows no replay in this window, but the token was handed over in the same way; the report must ask for that account's sessions to be revoked too.
- Where
- entra-signins.csv, IP address 198.51.100.23 and Status Success.
- Usual mistake
- Counting only the account whose mailbox was abused, or counting the password-spray failures as compromises.
Q042 points
At 06:44:18 s.kaya signs in from 203.0.113.77 with 'MFA requirement satisfied by claim in the token' and no password failure before it. What does this show?
AnswerB — No prompt was shown: the session presented a token that already carried the MFA claim, which fits a session issued through the proxy 13 minutes earlier being used from another address.
The result text means the requirement was met by a claim already in the token, not by a new prompt. Different address, different autonomous system (64502 against 64501), a different browser (Chrome against the user's Edge) and no credential step: the pattern of a replayed session. The spray failures (50126) never succeed.
- Where
- entra-signins.csv, s.kaya rows from 198.51.100.23 and 203.0.113.77: Multifactor authentication result, Browser, Autonomous system number.
- Usual mistake
- Reading 'MFA satisfied' as 'the user approved a prompt here'.
Q051 point
From which address was the mailbox read through Outlook on the web after the replayed sign-in?
Answer203.0.113.77
The MailItemsAccessed records with ClientInfoString Client=OWA and MailAccessType Bind for s.kaya carry ClientIPAddress 203.0.113.77 from 06:46:12. The proxy address 198.51.100.23 appears only in the two sign-ins: it relayed the logon, it did not read mail.
- Where
- ual-export.csv, AuditData ClientIPAddress of MailItemsAccessed rows for s.kaya.
- Usual mistake
- Answering the proxy address because it was the first outside address.
Q062 points
How many distinct messages did 203.0.113.77 open (MailAccessType Bind) in the window?
Answer12
There are 10 Bind records from the address, and their OperationCount values add up to 15, because binds within two minutes are aggregated into one record and the next morning's session re-opened three invoice threads. Counting distinct InternetMessageId values in the Folders items gives 12: ten from the Inbox and the two customer replies in \RSS Akışları.
- Where
- ual-export.csv, MailItemsAccessed, ClientIPAddress 203.0.113.77, Folders.FolderItems.InternetMessageId.
- Usual mistake
- Giving the number of rows (10) or the sum of OperationCount (15).
Q072 points
s.kaya's mailbox also has MailItemsAccessed Sync records every hour from 192.0.2.10. What do they show?
AnswerC — That the user's desktop Outlook synchronised a folder from the office address; a Sync record names the folder, not the messages, and none comes from 203.0.113.77, whose client recorded binds.
Sync is recorded for desktop Outlook and names a folder; all items in it must then be treated as accessed by that client. Here every Sync comes from the office address with Client=MSExchangeRPC. Had one come from the attacker's address, the whole folder would have to be reported as exposed.
- Where
- ual-export.csv, MailItemsAccessed rows with MailAccessType Sync; export-metadata.txt, export 1.
- Usual mistake
- Treating every MailItemsAccessed row as the same kind of evidence.
Q082 points
When was the inbox rule created? UTC.
Answer2026-07-07 07:21:44
New-InboxRule with Name '..' from ClientIP 203.0.113.77:50432 and the same SessionId as the morning's binds. A two-dot name is easy to miss in the rules list.
- Where
- ual-export.csv, Operation New-InboxRule.
- Usual mistake
- Looking only for Set-Mailbox forwarding and concluding there was no rule.
Q091 point
Into which folder did the rule move the messages it matched?
Answerrss akışları
Parameters: MoveToFolder 'RSS Akışları', SubjectOrBodyContainsWords 'IBAN;dekont;ödeme;hesap', MarkAsRead True, StopProcessingRules True. Replies about payment were marked read and filed in a folder few people open; the audit log records the rule, not each move.
- Where
- ual-export.csv, New-InboxRule, AuditData Parameters.
- Usual mistake
- Answering Deleted Items, where the sent copies went.
Q101 point
Which file did 203.0.113.77 download from s.kaya's OneDrive?
Answermusteri_cari_listesi_2026.xlsx
FileDownloaded at 07:12:09, SourceRelativeUrl Documents/Tahsilat. The customer ledger tells the sender whom to write to and how much each owes; the three recipients of the next day's message are customers.
- Where
- ual-export.csv, Operation FileDownloaded, ClientIP 203.0.113.77.
- Usual mistake
- Giving a FileAccessed row of another user from the office address.
Q112 points
When was the message the customer received sent from s.kaya's mailbox? UTC.
Answer2026-07-08 08:05:31
The Message-ID in the .eml matches the Send record at 08:05:31 from 203.0.113.77 and the message trace row to muhasebe@delta-perakende.example. The Date header says 08:05:31 +0000; the customer's own Received lines say 11:05:33 and 11:05:34 +0300, the same moment two seconds later.
- Where
- iban-degisikligi.eml, Message-ID and Date; ual-export.csv, Operation Send; message-trace.csv, the same MessageId.
- Usual mistake
- Copying 11:05:34 from the top Received line as UTC.
E-mail header fields (Received, Date, From, Message-ID)Local time to UTC
Q122 points
The customer's server records spf=pass, dkim=pass and dmarc=pass for akyeltekstil.example. What does that establish?
AnswerB — That the message was sent through Akyel's own Microsoft 365 tenant and signed for its domain, so it is not a spoofed lookalike; it says nothing about who controlled the session.
This is what makes a compromised-mailbox BEC convincing: every check the customer could run passes. The link to the replayed session comes from the audit log's Send record, not from the headers.
- Where
- iban-degisikligi.eml, Authentication-Results and DKIM-Signature.
- Usual mistake
- Treating a passed DKIM check as proof of authorship.
Q132 points
How many distinct messages were sent from s.kaya's mailbox by 203.0.113.77?
Answer3
Three Send records between 08:05:31 and 08:08:40, to Delta Perakende, Mavi Market and Kuzey Ambalaj, each later moved to Deleted Items and soft-deleted (08:09:55 to 08:10:21). The user's Sent Items no longer showed them; the audit log and the trace still do. Two more customers must be warned.
- Where
- ual-export.csv, Send, MoveToDeletedItems and SoftDelete from 203.0.113.77; message-trace.csv, the matching MessageId rows.
- Usual mistake
- Counting only the message the customer forwarded, or counting the MoveToDeletedItems and SoftDelete rows as further sends.
Q142 points
Delta Perakende replied to the message. When was that reply opened, and from where? Give the time in UTC.
Answer2026-07-08 12:52:38
The trace delivers the reply at 12:40:11. Its InternetMessageId appears once in MailItemsAccessed: a Bind at 12:52:38 from 203.0.113.77 with Path \RSS Akışları, the rule's folder. The user's own client shows no bind of it.
- Where
- message-trace.csv, the reply from muhasebe@delta-perakende.example; ual-export.csv, MailItemsAccessed with that InternetMessageId.
- Usual mistake
- Giving the delivery time from the trace as the time it was read.
Q152 points
When did the transfer leave Delta Perakende? UTC.
Answer2026-07-09 08:20:14
The receipt reads 09.07.2026 11:20:14 in the bank's local time (UTC+3): 08:20:14 UTC, about 75 minutes after the attacker read Mavi Market's reply at 07:05:10. Put the receipt on the same UTC line as the audit log before you write the sequence.
- Where
- odeme-dekontu.txt, İşlem tarihi and İşlem saati; export-metadata.txt, export 5.
- Usual mistake
- Copying 11:20:14 as UTC because the receipt does not write a zone.
Q162 points
Which sentence could the examiner sign from these files alone?
AnswerC — After a phishing message delivered at 06:12 UTC on 7 July, s.kaya's sign-in was relayed through 198.51.100.23 with the MFA prompt approved; from 06:44 UTC a session for the account was used from 203.0.113.77 with the MFA claim carried in the token. That session read 12 messages, downloaded the customer ledger, created the rule '..' moving payment replies to RSS Akışları, sent the bank change message to three customers on 8 July and deleted the copies. Delta Perakende's transfer left at 08:20 UTC on 9 July. b.aslan's sign-in was relayed through the same address.
Sentence c ties each act to a record and a session, uses UTC throughout, counts messages rather than rows and names the second exposed account. Sentence a names a person for acts done from another address; b contradicts the sign-in log; d ignores the audit log and the message trace.
- Where
- All five evidence files; each fact in sentence c comes from one of them.
- Usual mistake
- Writing the story the customer told instead of the one the records carry.
03Reconstructed timeline
The timeline as the correct answers build it. Local time is UTC+3.
| UTC | Local | Event | Source |
|---|---|---|---|
| 06:12:40 | 09:12:40 | 'Paylaşılan belge: 2026 Q3 Sipariş Formu' delivered to s.kaya, b.aslan and m.demir. | message-trace.csv |
| 06:31:05 | 09:31:05 | s.kaya's sign-in succeeds through 198.51.100.23 (AS64501) with the MFA prompt approved. | entra-signins.csv |
| 06:44:18 | 09:44:18 | A session for s.kaya is used from 203.0.113.77 (AS64502): MFA requirement satisfied by claim in the token. | entra-signins.csv |
| 06:52:17 | 09:52:17 | b.aslan's sign-in is relayed through the same proxy address. | entra-signins.csv |
| 07:12:09 | 10:12:09 | Musteri_Cari_Listesi_2026.xlsx downloaded from OneDrive by 203.0.113.77. | ual-export.csv |
| 07:21:44 | 10:21:44 | Inbox rule '..' created: payment words move to RSS Akışları, marked read. | ual-export.csv |
| 08:05:31 | 11:05:31 | First of three bank change messages sent to customers; the copies are deleted by 08:10. | ual-export.csv |
| 12:52:38 | 15:52:38 | Delta Perakende's reply, filed in RSS Akışları, is opened from 203.0.113.77. | ual-export.csv |
| 07:05:10 | 10:05:10 | Mavi Market's reply is opened from the same address. | ual-export.csv |
04Scoring
Questions 1–11 carry one point each and question 12 carries three: 28 points in all. The finding paragraph is not scored by points; mark it against the four criteria below and discuss it in the debrief.
| Points | Next step |
|---|---|
| 25–28 | Sound. Move on to a supervised review of a real tenant's audit search. |
| 14–24 | Review each missed question with its explanation, then rebuild the timeline in the workbench from the audit log and the sign-ins alone. |
| 0–13 | Work through VP-03 first, then repeat this pack with the workbench filtered on 203.0.113.77. |
Finding paragraph: criteria
- Every time carries its basis; the receipt and the customer's headers are converted from local time.
- Messages are counted by InternetMessageId, and the report says why rows and OperationCount differ.
- The relayed sign-in and the replayed session are described separately, and 'MFA satisfied by claim' is not reported as a user approval.
- Acts are attributed to a session and an address, not to the user.
- The report names the two other customers and the second relayed account, and asks for their follow-up.
05Debrief
- MFA was on and it was used. A phishing proxy does not defeat the prompt; it carries the user's approval to someone else.
- An inbox rule is the quiet part of BEC. Look for it before you look for forwarding.
- A message that passes every authentication check can still be fraudulent when the mailbox itself is in someone else's hands.
- The audit log counts operations, not messages. The number in the report must be the one the reader thinks it is.
06Model finding
On 7 July 2026 at 06:12 UTC a message 'Paylaşılan belge: 2026 Q3 Sipariş Formu' was delivered to s.kaya, b.aslan and m.demir (message-trace.csv). At 06:31:05 UTC s.kaya's sign-in succeeded from 198.51.100.23 (AS64501) with the MFA prompt completed, and at 06:52:17 b.aslan's did the same (entra-signins.csv). From 06:44:18 UTC a session for s.kaya was used from 203.0.113.77 (AS64502, a different browser) with 'MFA requirement satisfied by claim in the token'. From that address the audit log records 12 distinct messages opened (10 Bind records, OperationCount 15), the download of Musteri_Cari_Listesi_2026.xlsx at 07:12:09, the creation at 07:21:44 of the inbox rule '..' moving messages containing IBAN, dekont, ödeme or hesap to RSS Akışları and marking them read, three sends of 'Banka hesap bilgilerimiz güncellendi' on 8 July between 08:05:31 and 08:08:40 to Delta Perakende, Mavi Market and Kuzey Ambalaj, and the deletion of their copies by 08:10:21 (ual-export.csv). The message the customer forwarded carries the Message-ID of the first send and passed SPF, DKIM and DMARC for akyeltekstil.example; that shows it left the tenant, not who controlled the session. The replies of Delta Perakende and Mavi Market were opened from 203.0.113.77 in RSS Akışları at 12:52:38 on 8 July and 07:05:10 on 9 July. Delta Perakende's transfer left at 08:20:14 UTC on 9 July (receipt 11:20:14 local). Limits: the proxy and the host behind 203.0.113.77 were not examined; b.aslan's sessions and the two other customers need follow-up.