> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/enterprise-architecture/the-cloud/m365/business-email-compromise.md).

# Business Email Compromise

{% embed url="<https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/main/PwC-Business_Email_Compromise-Guide.pdf>" %}

{% embed url="<https://answers.microsoft.com/en-us/outlook_com/forum/all/phishing-email-but-has-same-domain/01a54f06-5a7c-4770-b691-b7b4967a8c3c>" %}

### MailSniper:

Groups with full rights in Exchange:&#x20;

* Organization Management
* Exchange Organization Administrators

By default, the “Domain Admins” group does not have “full access” rights to mailboxes on Exchange.

BUT,  the “Domain Admins” group has the ability to grant this access to any account. You can always resort to adding your own user to the group with a DA

From a workstation on the domain the following command can be run as a domain admin to add a user to the “Exchange Organization Administrators” group:

{% code overflow="wrap" %}

```powershell
net groups “Exchange Organization Administrators” <username-of-your-user> /DOMAIN /ADD
```

{% endcode %}

#### ApplicationImpersonation

Users with the “ApplicationImpersonation” [role](https://technet.microsoft.com/en-us/library/dd776119\(v=exchg.150\).aspx) have the ability to access other user's mailboxes.&#x20;

The “ApplicationImpersonation” role is a Microsoft Exchange server role that, when granted to a user, allows them to impersonate other users when accessing mailboxes. This role can be granted at the Exchange Management Shell with the following command:

```powershell
New-ManagementRoleAssignment -Name:impersonationAssignmentName 
-Role:ApplicationImpersonation -User:username-of-impersonation-user
```

{% embed url="<https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/>" %}

### Security portals <a href="#security-portals" id="security-portals"></a>

{% embed url="<https://learn.microsoft.com/en-us/microsoft-365/security/defender/portals?view=o365-worldwide>" %}

{% embed url="<https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-phishing>" %}

{% embed url="<https://github.com/randomaccess3/Awesome-BEC>" %}

{% embed url="<https://www.crowdstrike.com/en-us/blog/crowdstrike-services-identifies-logging-inconsistencies-in-microsoft-365/>" %}

{% embed url="<https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-identity-device-access-policies-exchange?view=o365-worldwide>" %}

{% embed url="<https://www.bleepingcomputer.com/news/security/microsoft-365-admin-portal-abused-to-send-sextortion-emails/>" %}