What are the signs that a business email account is compromised?
Microsoft's response guidance lists several of these signs of a compromised mailbox, and almost all of them also apply to Google Workspace:
- Inbox rules nobody created, especially ones that forward to external addresses or move messages to folders people rarely check, such as RSS Subscriptions or Junk Email.
- Messages in Sent Items or Deleted Items that the user did not write, often replies in invoice or payment threads.
- External forwarding that was set up recently.
- MFA prompts nobody asked for, password changes or unexplained lockouts.
- Sign-ins from countries, IP addresses or devices that don't fit the user.
- The mailbox blocked from sending because it sent bulk email.
- Customers or suppliers asking about a strange email they received from that account.
- New apps with permission to read email or files.
What should you do first to contain a compromised account?
Order matters. First you cut off the attacker's access, then you clean up what they left behind. Document everything before you delete it, because it is evidence.
- Block sign-in. Microsoft recommends disabling the account while the investigation is ongoing. In Google Workspace, suspending the user resets their sign-in cookies and OAuth tokens.
- Revoke sessions and tokens. Changing the password does not guarantee that sessions already open are closed: in Microsoft Entra ID, access tokens last one hour by default, and some applications keep their own sessions until they expire.
- Reset the password from a clean device and do not send it by email. If the account is synced from an on-premises Active Directory, change it there. Microsoft advises doing it twice to mitigate pass-the-hash attacks.
- Remove any MFA methods and registered devices the user doesn't recognize.
- Export and then delete malicious inbox rules, forwarding and delegations, including hidden rules.
- Revoke consented applications that are not authorized and delete app passwords. In Microsoft 365, app passwords are not revoked automatically when the password changes.
- Review the admin roles assigned to the account and remove any that shouldn't be there.
Where do you do each step in Microsoft 365 and Google Workspace?
| Action | Microsoft 365 | Google Workspace |
|---|---|---|
| Block access | Disable the account in Entra ID | Suspend the user in the Google Admin console |
| Close sessions | Revoke sessions in Entra ID or Revoke-MgUserSignInSession | Suspension resets cookies and OAuth tokens |
| Rules and forwarding | Get-InboxRule with -IncludeHidden, plus the mailbox forwarding properties | The user's Gmail filters and forwarding, which you can also review with the Gmail API |
| Apps with permissions | Apps with user consent in Entra ID | OAuth log events and token revocation |
| App passwords | The user deletes them and creates new ones | Delete the ones the user created |
| Investigation | Sign-in and audit logs, message trace | User log events (up to six months), Email Log Search, Drive log events |
How do you investigate what the attacker did with the account?
Set a time window from the first suspicious sign-in to containment, and answer these questions:
- How and from where did they get in? IP address, location, browser, client app and whether they passed MFA. MFA passed from an unusual IP address points to session theft or a user tricked into approving a prompt.
- What did they read or download? Check mailbox item access logs and activity in OneDrive, SharePoint or Drive, depending on your license and the auditing you have enabled.
- What did they send? Check message trace and the Sent Items folder, paying close attention to invoice threads and internal emails.
- What did they change? Rules, MFA methods, apps, delegations and the email signature.
- Did they touch other accounts? Look for the same IP addresses and the same rule pattern across your other users.
If the attacker could read emails containing customer or employee data, check with your legal counsel about any obligations that may apply to you.
How do attackers usually get into a business account?
- Credential phishing, including adversary-in-the-middle (AiTM) phishing, which steals the session cookie and gets around MFA.
- Passwords that were reused, or stolen by infostealers on personal computers.
- MFA fatigue: repeated prompts until someone approves one.
- Consent to a malicious OAuth app, which gives access to email without needing a password.
- Legacy protocols that don't support MFA, if they are still enabled in your environment.
What should you do after you recover the account?
- Phone the contacts who received fraudulent emails from the account, especially if there were payment requests or bank account changes.
- Require phishing-resistant MFA (FIDO2 security keys or passkeys) for administrators and for finance.
- Apply Conditional Access policies that require a managed device or trusted locations.
- Block automatic forwarding to external domains by policy.
- Limit which apps users can approve on their own.
- Create alerts for new forwarding rules and for changes to MFA methods.
How Ciberia helps with compromised accounts
Ciberia MDR integrates with your identity platform and your email, and monitors that telemetry 24/7 alongside the endpoint, network and cloud telemetry you already have. The AI proposes the response, an analyst validates actions with impact, and containment is orchestrated on your own tools. The SLA is 15 minutes from critical alert to initial containment, and every automatic action is logged.
With Threat Hunting, Ciberia searches retrospectively for persistence and lateral movement, and turns every finding into a new detection rule. Ciberia CTM monitors your employees' leaked credentials and sends alerts with context and the recommended action.
