Business Email Compromise (BEC) Response Plan for Microsoft Office 365

Executive Summary

This document provides a comprehensive response plan for addressing a suspected Business Email Compromise (BEC) event in a Microsoft Office 365 environment. It is designed to guide the Cybersecurity Incident Response Team (CSIRT) through triage, analysis, containment, eradication, restoration, and post-incident activities, while ensuring evidence preservation through litigation hold. The plan specifically addresses scenarios where the threat actor operates from another organization’s Microsoft 365 tenant, over which there is no access or knowledge of their policies or processes. By leveraging Microsoft 365 Defender, Microsoft Purview, and industry best practices, this plan ensures a swift, secure, and legally defensible response to mitigate damage, protect the organization, and coordinate with external parties as needed.

BEC Response Checklist

The following checklist summarizes key actions to be completed during a BEC incident response. Refer to the detailed sections below for step-by-step guidance.

• Triage
  • Log a ticket
  • Acknowledge user report of suspicious email(s).
  • Validate incident using Microsoft Defender for Office 365 (check email headers, alerts).
  • Confirm if the email originates from an external tenant (analyze sender domain/tenant ID).
  • Classify incident severity (low, medium, high).
  • Assign incident owner in Microsoft Defender portal.
  • Enable litigation hold on affected user’s mailbox in Microsoft 365 Compliance Center.
• Analysis
  • Review email details (headers, URLs, attachments) and Unified Audit Logs (UAL).
  • Collect Indicators of Compromise (IOCs) (e.g., malicious URLs, IPs, email addresses).
  • Assess scope of compromise within your tenant (accounts, services).
  • Engage forensics team for sensitive data or litigation cases.
  • Consult legal counsel for regulatory or litigation risks.
  • Notify external organization if threat actor is in their tenant (send IOCs, request investigation).
• Containment
  • Disable/lock compromised accounts in Microsoft Entra ID.
  • Reset passwords and enforce MFA for affected accounts.
  • Disable malicious mail rules in affected mailboxes.
  • Quarantine/remove malicious emails using Microsoft Defender for Office 365.
  • Block IOCs in tenant-wide policies (URLs, IPs, domains).
  • Coordinate with external organization for updates on their investigation.
• Eradication
  • Remove threat actor access (disable unauthorized accounts/apps).
  • Remediate vulnerabilities (e.g., patch systems, harden configurations).
  • Clean affected systems (use Microsoft Defender for Endpoint).
  • Conduct full tenant review for residual threats.
  • Monitor for recurring activity from external tenant.
• Restoration
  • Re-enable secure user accounts and services.
  • Validate recovery (monitor for re-compromise, verify backups).
  • Enhance security controls (e.g., Safe Links, Safe Attachments).
  • Conduct employee training on phishing/BEC recognition.
• Post-Incident Activities
  • Create incident report (include external tenant details).
  • Conduct lessons learned meeting and update response plan.
  • Maintain litigation hold until legal counsel approves lifting.
  • Notify regulators/stakeholders if required (include external tenant details).
  • Strengthen defenses (e.g., enhanced monitoring, configuration reviews).
  • Close ticket

1. Incident Response Triage

Triage is the initial phase to validate and prioritize the incident, ensuring rapid response to limit damage.

Log a Ticket

• Create a ticket in the incident management system to formally document the reported suspicious email(s) and initiate the response process.

Acknowledge User Report

• Confirm receipt of the user’s report of suspicious email(s) via an automated ticketing system or direct communication.
• Instruct the user not to interact with the email (e.g., clicking links, replying, or forwarding) to prevent further compromise.

Validate the Incident

• Review the flagged email(s) in Microsoft Defender for Office 365 or Microsoft 365 Defender portal to confirm suspicious indicators (e.g., spoofed sender, malicious links, or unusual content).
• Check email headers to determine the originating tenant (e.g., sender’s domain or tenant ID in Microsoft 365 authentication headers).
• Identify if the email originates from another organization’s Microsoft 365 tenant by analyzing the sender’s domain and SMTP headers.
• Check for alerts in Microsoft Defender for Office 365, such as phishing or malware verdicts, and correlate with other signals (e.g., Microsoft Defender for Endpoint or Identity).
• Determine if the email is a false positive (e.g., part of a phishing simulation or sent to a SecOps mailbox).

Classify Severity

• Assign a severity level (low, medium, high) based on potential impact (e.g., financial fraud, data exfiltration, or privileged account compromise).
• Escalate high-severity incidents to the CSIRT immediately, noting if the threat actor is likely in an external tenant.

Assign Incident Owner

• Assign the incident to a security analyst or team in the Microsoft Defender portal for ownership and tracking.
• Document the incident in a Security Information and Event Management (SIEM) system (e.g., Microsoft Sentinel) for centralized logging, noting the external tenant involvement.

Enable Litigation Hold

• Immediately enable litigation hold on the affected user’s mailbox in the Microsoft 365 Compliance Center to preserve all email data, including deleted items, for forensic analysis and potential legal proceedings.
• Navigate to Microsoft 365 Compliance Center > eDiscovery > Core eDiscovery.
• Create a new case, add the affected user’s mailbox to the hold, and enable litigation hold.
• Verify that the hold is active to ensure no data is purged.

2. Analysis

Analyze the incident to understand the scope, impact, and tactics used by the threat actor, including considerations for external tenant involvement.

Review Email and Audit Logs

• Use the Microsoft 365 Defender portal to review email details, including headers, URLs, attachments, and delivery locations.
• Analyze Unified Audit Logs (UAL) in Microsoft 365 to identify suspicious activities within your tenant, such as:
  • Unauthorized logins (e.g., foreign IP addresses or unusual devices).
  • Mail rule creation (e.g., auto-forwarding to external addresses).
  • File access in OneDrive or SharePoint.
• Example UAL query:

  Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -UserIds  -Operations UserLoggedIn, MailboxRuleCreated

  Copy to Clipboard

Identify Indicators of Compromise (IOCs)

• Collect IOCs such as malicious URLs, IP addresses, email addresses, or file hashes from the email and related logs.
• Note the sender’s domain and any tenant-specific identifiers (e.g., tenant ID in email headers) to confirm the external tenant’s involvement.
• Use Microsoft Defender for Office 365’s Explorer to view email clusters (e.g., malicious, suspicious, or clean) and identify related threats.

Assess Scope of Compromise

• Check for compromised accounts within your tenant by reviewing recently created users, disabled MFA, or unusual authentication tokens.
• Investigate access to other Microsoft 365 services (e.g., OneDrive, SharePoint, Teams) for signs of data exfiltration or lateral movement.
• Determine if the attack involved phishing, credential reuse, or exploited vulnerabilities (e.g., Microsoft Exchange).
• Acknowledge that analysis of the external tenant is not possible due to lack of access; focus on impacts within your tenant.

Engage Forensics Team

• If the incident involves sensitive data or potential litigation, engage a digital forensics team to perform in-depth analysis using tools like Microsoft Purview or third-party solutions.
• Preserve volatile data (e.g., email headers, log files) in a forensically sound manner, storing copies in a password-protected, secure location.

Consult Legal Counsel

• If sensitive data (e.g., PII, financial records) is potentially exposed, consult legal counsel to assess regulatory requirements (e.g., GDPR, CCPA) and litigation risks.
• Discuss the external tenant scenario to determine if legal notifications or coordination with the other organization are required.

Notify External Organization

• If the threat actor operates from another organization’s tenant, identify the organization using the sender’s domain or tenant ID.
• Send a formal notification to their security or IT contact (e.g., abuse@domain.com or security@domain.com).
• Include in the notification: timestamp and nature of the suspicious email(s), sender’s email and domain, IOCs (e.g., URLs, IPs, hashes), and a request to investigate their tenant, without sharing sensitive internal data.
• Use a professional, neutral tone, noting you have no knowledge of their policies. Example:
  Subject: Notification of Potential Business Email Compromise Involving Your Tenant Dear [Organization/Security Team], We have identified suspicious email activity originating from an account in your Microsoft 365 tenant ([sender@domain.com]). The email(s), received on [date/time], exhibit characteristics of a Business Email Compromise (BEC), including [brief description, e.g., spoofed headers, malicious links]. To assist your investigation, we are sharing the following indicators of compromise: - Sender: [sender@domain.com] - Malicious URL: [if applicable] - IP Address: [if applicable] We kindly request that you investigate this matter within your tenant and take appropriate action. Please let us know if you require additional details or coordination. We have no knowledge of your internal policies or processes and are providing this information to support a secure resolution. Best regards, [Your Name] [Your Organization] [Contact Information]
  Copy to Clipboard
• Log the notification in your incident tracking system and keep a copy for legal and audit purposes.
• If no response is received within 24-48 hours, escalate to legal counsel or contact Microsoft’s support team for assistance with the external tenant.

3. Containment

Contain the incident to prevent further damage while preserving evidence, focusing on actions within your tenant.

Isolate Compromised Accounts

• Disable or lock any compromised accounts in your tenant in Microsoft Entra ID to prevent further access.
• Navigate to Microsoft Entra ID > Users > Select User > Block Sign-in.
• Revoke all authentication tokens for affected user(s) to invalidate active sessions:

  Revoke-AzureADUserAllRefreshToken -ObjectId 

  Copy to Clipboard

Reset Credentials

• Reset passwords for all affected accounts in your tenant, starting with email accounts, and enforce strong, unique passwords.
• Enable or re-enable multi-factor authentication (MFA) for all affected users.

Disable Malicious Mail Rules

• Identify and disable unauthorized mail rules (e.g., auto-forwarding or deletion rules) in affected mailboxes within your tenant:

  Get-InboxRule -Mailbox  | Remove-InboxRule

  Copy to Clipboard
• Review rules across your tenant for suspicious activity.

Isolate Malicious Emails

• Use Microsoft Defender for Office 365 to quarantine or remove malicious emails from all mailboxes in your tenant.
• Navigate to Microsoft 365 Defender > Email & Collaboration > Explorer.
• Search for the malicious email or cluster and select Soft Delete or Move to Quarantine.
• Preserve copies of malicious emails in a secure, offline location for forensic analysis.

Block IOCs

• Block malicious IPs, URLs, or domains in Microsoft Defender for Office 365’s tenant-wide policies.
• Navigate to Microsoft 365 Defender > Policies & Rules > Threat Policies > Tenant Allow/Block Lists.
• Share IOCs with your security team to update firewalls, proxies, and other defenses.
• If the external tenant’s domain is confirmed malicious, consider temporarily blocking emails from that domain, but consult legal counsel to avoid disrupting legitimate communications.

Coordinate with External Organization

• If the external organization responds, provide additional IOCs or details as requested, ensuring no sensitive internal data is shared.
• Request updates on their investigation (e.g., confirmation of account compromise or remediation) to assess ongoing risk to your tenant.
• If the external organization does not respond, escalate to Microsoft’s support team or a third-party incident response provider for guidance.

4. Eradication

Eliminate the threat actor’s access and mitigate vulnerabilities within your tenant.

Remove Threat Actor Access

• Confirm all compromised accounts in your tenant are disabled or reset, and no unauthorized users or applications remain.
• Review Microsoft Entra ID for suspicious application permissions or certificates:

  Get-AzureADApplication | Select-Object DisplayName, AppId, Permissions

  Copy to Clipboard

Remediate Vulnerabilities

• Patch or mitigate any exploited vulnerabilities in your tenant (e.g., unpatched Microsoft Exchange servers).
• Harden Microsoft 365 configurations using recommendations from the Microsoft 365 Secure Score or a third-party review.
• Example: Enable Advanced Phishing Protection, enforce MFA, and restrict legacy authentication.

Clean Affected Systems

• If malware is detected, use Microsoft Defender for Endpoint to isolate and remediate affected devices in your tenant.
• Rebuild or restore compromised systems from a known good backup after preserving forensic images.

Conduct Full Tenant Review

• Perform a comprehensive log analysis to ensure no residual threat actor activity in your tenant (e.g., foreign logins, suspicious file downloads).
• Use Microsoft Defender for Office 365 to review all mailboxes for additional malicious emails or rules.

Monitor External Tenant Activity

• Continue monitoring for emails from the external tenant’s domain to detect recurrence of malicious activity.
• If the external organization confirms remediation, validate by checking for new suspicious emails or IOCs.

5. Restoration

Restore systems and services in your tenant to a secure state while maintaining vigilance.

Restore Accounts and Services

• Re-enable user accounts in your tenant after verifying they are secure (e.g., new passwords, MFA enabled).
• Restore access to Microsoft 365 services (e.g., email, OneDrive, SharePoint) after confirming no residual threats.

Validate Recovery

• Monitor restored systems for signs of re-compromise using Microsoft Defender for Office 365 and Microsoft Sentinel.
• Verify that backups used for restoration are free of malware or unauthorized changes.

Enhance Security Controls

• Implement recommended configurations from Microsoft Defender for Office 365, such as Safe Links and Safe Attachments.
• Conduct a Microsoft 365 security assessment to identify and address configuration weaknesses.

Employee Training

• Conduct security awareness training to educate employees on recognizing phishing and BEC attacks, including those originating from external tenants.
• Simulate phishing campaigns to test employee resilience and improve detection.

6. Post-Incident Activities

Document findings, improve defenses, and meet legal obligations.

Create Incident Report

• Document a detailed timeline of the incident, including IOCs, affected systems, and response actions.
• Include details of the external tenant involvement and communications with the other organization.
• Distribute a technical report to the CSIRT and a summary to relevant stakeholders (e.g., leadership, legal counsel).

Conduct Lessons Learned

• Hold a post-incident meeting to discuss what worked, what didn’t, and areas for improvement.
• Update incident response plans to include procedures for handling external tenant scenarios (e.g., standardized notification templates).

Maintain Litigation Hold

• Keep litigation hold active until legal counsel confirms it can be lifted, ensuring all relevant data is preserved for potential litigation or regulatory inquiries.

Notify Regulators and Stakeholders

• If sensitive data was exposed, work with legal counsel to draft and send compliant notification letters to affected parties and regulators.
• Include details of the external tenant’s involvement in regulatory reports, if required.
• Standardize and deduplicate notification lists, cross-referencing with databases like the National Change of Address.

Strengthen Defenses

• Deploy additional monitoring via Microsoft Defender for Office 365 or a managed detection and response (MDR) service.
• Regularly review Microsoft 365 configurations against industry standards (e.g., Center for Internet Security benchmarks).
• Consider adding the external tenant’s domain to a watchlist for enhanced monitoring, if appropriate.

Close Ticket

• Close the incident ticket in the incident management system after confirming all response actions are complete and documented.

Additional Notes

This plan aligns with Microsoft Office 365 security features and industry best practices for BEC response, ensuring a thorough and defensible approach to incident management, including scenarios involving external tenants.