Executive Summary
Security monitoring systems detected suspicious login activity on a Microsoft 365 user account originating from IP addresses outside the user's normal geographic location.
The unusual authentication behaviour triggered security alerts, indicating a potential account compromise.
CyberQuell was engaged to determine:
- whether the user account had been compromised
- what activity occurred within the mailbox
- whether any sensitive data had been accessed or exfiltrated
The investigation confirmed that the account had been accessed by an unauthorised actor who viewed a small number of emails through a web browser session.
No persistence mechanisms, mailbox rule changes, or large-scale data access were identified.
The incident was quickly contained through credential resets and token revocation, followed by forensic validation to confirm that the attacker no longer had access to the environment.
Client Environment
The organisation operates a Microsoft 365 environment supporting internal communication and collaboration.
Key components include:
- Microsoft 365 email services
- Azure Active Directory authentication
- security monitoring through Microsoft Defender and Sentinel
- centralised logging through unified audit logs
Security alerts are generated when authentication behaviour deviates from expected user patterns.
Incident Trigger
The incident began when security monitoring tools detected login attempts from IP addresses located in a different region than the user's normal login patterns.
These authentication events triggered security alerts indicating possible unauthorised access.
Because unusual login behaviour can indicate credential theft or phishing attacks, the organisation initiated a deeper investigation.
Security Signals Observed
The security team observed several indicators that suggested potential account compromise:
- authentication attempts from unfamiliar geographic locations
- login activity through web browser sessions
- security alerts generated by Microsoft Defender monitoring systems
These signals prompted escalation to a formal incident investigation.
CyberQuell Investigation
CyberQuell conducted a structured investigation to determine the scope and impact of the compromise.
Phase 1 — Authentication Log Analysis
Azure Active Directory sign-in logs were reviewed to analyse:
- authentication timestamps
- geographic login locations
- IP address activity
- login success and failure events
This analysis confirmed that the suspicious login activity originated from an unauthorised source.
Phase 2 — Mailbox Activity Review
Unified audit logs and message trace data were analysed to determine what actions occurred within the mailbox.
The investigation found that the attacker:
- accessed the mailbox through a web browser
- viewed approximately ten emails
- accessed messages in both Inbox and Sent Items
No bulk data access or mailbox exports were detected.
Phase 3 — Persistence Checks
CyberQuell reviewed the account for signs of persistence or further compromise.
The investigation verified that:
- no mailbox rules had been created
- no unauthorised MFA devices were registered
- no application tokens were created
- no mailbox synchronisation tools were used
Why This Incident Matters
Phishing remains one of the most common methods attackers use to gain access to corporate email accounts.
Even short-lived access to an email account can allow attackers to gather sensitive information, impersonate users, or launch additional phishing campaigns.
Rapid detection and containment are critical to preventing further damage.
Key Findings
The investigation confirmed that the incident involved unauthorised access to a single user mailbox.
Key findings included:
- attacker accessed the mailbox through web authentication
- approximately ten emails were viewed
- no evidence of large-scale data access or exfiltration
- no persistence mechanisms were established within the account
Remediation & Hardening
- Resetting the affected user's password
- Revoking active authentication tokens
- Resetting multi-factor authentication configuration
- Reviewing mailbox access logs
Additional improvements were recommended to strengthen phishing detection and identity security monitoring across the organisation.
Business Impact
CyberQuell's investigation enabled the organisation to quickly understand the scope of the compromise and confirm that the attacker's activity was limited.
The organisation was able to:
- contain the compromised account quickly
- confirm that only a small number of emails were accessed
- verify that no persistence mechanisms remained active
- strengthen identity security monitoring processes
This helped restore confidence in the integrity of the organisation's Microsoft 365 environment.
Key Lessons
Suspicious login alerts should always be investigated quickly.
Phishing attacks can lead to rapid account compromise if credentials are captured.
Unified audit logs are critical for understanding attacker activity.
Immediate containment actions significantly reduce incident impact.
