Understanding BEC and its evidence sources

What is BEC?

Business Email Compromise (BEC) is a form of fraud involving business email. An attacker may impersonate a trusted person or use a compromised account to deceive others.

For example, an attacker might join an existing email conversation and ask a customer to send a payment to a different bank account.

These notes focus on investigations involving compromised Microsoft 365 accounts. Alongside fraud, an investigator may need to check for mailbox access, forwarding rules, file access and phishing sent from the account.

Where DFIR fits

Digital Forensics and Incident Response (DFIR) involves investigating security incidents and responding to them. In a BEC investigation, this means securing compromised access, examining evidence and understanding the impact.

Access: How did the attacker gain access, and which accounts were affected?
Activity: What did they do after gaining access?
Continued access: Did they change anything that could let them keep accessing information?
Impact: Which emails, files or business processes may have been affected?

The tools help us search the evidence. The investigation questions guide what we search for.

The main evidence sources

Each source records a different part of the activity. Together, they help explain access and what followed.

Microsoft Entra sign-in logs: Sign-in attempts, their results, the application involved, and details such as time and IP address.
Microsoft 365 Unified Audit Log: Recorded activity across services such as Exchange, SharePoint, OneDrive and Teams. It is available through Microsoft Purview Audit.
Exchange message trace: How an email moved through the service, including its sender, recipients and delivery status.
Application logs: Activity inside a connected application, such as a customer record being viewed or a report being downloaded.

Choose evidence for the question

AccessSign-in logs: how the account connected
ActivityAudit and application logs: recorded actions
DeliveryMessage trace: where email went

Together, these sources help explain how an account was accessed, what actions occurred and where email was sent.

Sign-in logs: investigating access

Microsoft Entra ID manages identities and access to applications. Its sign-in logs help us examine when an account attempted to sign in, whether it succeeded, and the surrounding context.

A successful sign-in from an unfamiliar IP address could provide a lead. Compare it with the user’s normal activity, travel and VPN use before deciding whether it was suspicious.

A successful application sign-in does not tell us everything the account did inside that application.

Audit logs: investigating activity

The Unified Audit Log (UAL) brings together activity records from Microsoft 365 services. These are records of actions rather than copies of the original emails or files.

Mailbox activity: Mail access, inbox-rule creation and mailbox changes.
File activity: Access, downloads and sharing in SharePoint or OneDrive.
Other service activity: Relevant recorded actions in services such as Teams.

Understand what each event records before drawing a conclusion. Available evidence depends on the logging and retention in place.

Message trace: following email delivery

If a compromised account sent a fraudulent payment request, message trace could help identify its recipients and delivery results.

Mailbox auditing answers a different question: what activity occurred in the mailbox? Both sources can be useful in the same investigation.

Connected applications: looking beyond email

Single sign-on (SSO) allows a user to access connected applications through an identity service, often without entering separate credentials for each application. A compromised account may therefore affect more than email.

Sign-in logs might show access to a customer-management application. To investigate whether customer records were viewed or exported, we would usually need that application’s own activity logs.

Tools for analysing logs

Investigation tools help analysts search, filter and organise collected logs.

ELK stack: ELK stands for Elasticsearch, Logstash and Kibana. Together, these tools form a stack—a group of technologies that work together.
Elasticsearch: Stores and searches data.
Logstash: Collects and processes data.
Kibana: Provides an interface for searching and visualising data.
SOF-ELK: SOF-ELK stands for Security Operations and Forensics ELK. It is a preconfigured platform built around the Elastic stack for analysing forensic and security logs. Its ready-made configurations help investigators explore collected evidence and identify related activity.

Start with the question you need to answer, then use the tool to find and examine the relevant evidence.

Bringing the evidence together

An unusual sign-in can provide an initial lead. Audit records help explain mailbox changes and access. Message trace helps follow outgoing email.

Check whether the records belong to the same activity and whether there is a legitimate explanation. Then use them to build a timeline and choose what to investigate next.

Connecting evidence in a BEC investigation

01Sign-in leadCheck account and access context
02Mailbox activityReview rules and mail access
03Outgoing emailFollow recipients and delivery

Example investigation sequence. Check whether the records relate to the same activity.

Key takeaway

Start with a clear investigation question, then choose the evidence source that can help answer it. Sign-in logs explain access, audit logs describe recorded activity, message trace follows delivery, and application logs provide detail inside connected services.