Responding to a Compromised Email Account - Microsoft Defender for Office 365 (original) (raw)

User credentials control access to Microsoft Entra ID accounts, which are central to compromise investigations. Once an attacker gains access to the account, they can access the associated Microsoft 365 mailbox, SharePoint folders, or files in the user's OneDrive. Remediation and investigation of a compromised user focuses on the affected account and the services associated with the account.

Attackers often use a compromised user's mailbox to send to recipients inside and outside of the organization. Business Email Compromise (BEC) is a prolific type of attack and is addressed in this article.

This article addresses the symptoms of account compromise (specifically, the mailbox) and how to regain control of the compromised account.

Important

The following button lets you test and identify suspicious account activity. Use this test with the guidance in this article to gain insight into potentially compromised accounts and determine the necessary remediation actions.

Common symptoms of a compromised Microsoft 365 email account

One or more of the following activities might indicate an account associated with a Microsoft 365 mailbox is compromised:

If the mailbox exhibits any of these symptoms, use the steps in the next section to regain control of the account.

Secure and Restore Email Function to a Compromised Microsoft 365 Mail Enabled Account

After the attacker gains access to an account, you need to block access to the account as soon as possible.

The following steps address known methods that might allow the attacker to maintain persistence and regain control of the account later. Be sure to address each step.

Step 1: Disable the affected user account

For detailed syntax and parameter information, see Update-MgUser

Step 2: Revoke User Access

This step immediately invalidates any active access using the stolen credentials, and prevents the attacker from accessing more sensitive data or doing unauthorized actions on the compromised account.

  1. Run the following command in an elevated PowerShell window (a PowerShell window you open by selecting Run as administrator):
Set-ExecutionPolicy RemoteSigned
  1. If necessary, run the following commands to install the required modules for Microsoft Graph PowerShell:
Install-Module Microsoft.Graph.Authentication  
Install-Module Microsoft.Graph.Users.Actions
  1. Connect to Microsoft Graph by running the following command:
Connect-MgGraph -Scopes User.RevokeSessions.All
  1. Replace with the user's account (user principal name or UPN), and then run the following command:
Revoke-MgUserSignInSession -UserId <UPN>

For example: 

Revoke-MgUserSignInSession -UserId jason@contoso.onmicrosoft.com

For more information, see Revoke user access in an emergency in Microsoft Entra ID.

Step 3: Review the MFA registered devices for the affected user

Identify and remove any suspicious devices added by an attacker. Also, ensure any unrecognized MFA methods are removed to secure the user's account.

For instructions, see MFA methods removed

Remove and revoke any applications that shouldn't be allowed.

For instructions, see Application review.

Step 5: Review the administrative roles assigned to the user

Remove any roles that shouldn't be allowed.

For more information, see the following articles:

Step 6: Review mail forwarders

Remove any suspicious mailbox forwarding that the attacker added.

  1. Connect to Exchange Online PowerShell.
  2. To see if mailbox forwarding (also known as SMTP forwarding) is configured on the mailbox, replace with the name, email address, or account name of the mailbox, and then run the following command:
Get-Mailbox -Identity \<Identity\> | Format-List Forwarding*Address,DeliverTo*

For example: 

Get-Mailbox -Identity jason@contoso.com | Format-List Forwarding*Address,DeliverTo*

Observe the values of the following properties:

  1. To see if any Inbox rules are forwarding email from the mailbox, replace with the name, email address, or account name of the mailbox, and then run the following command:
Get-InboxRule -Mailbox <Identity> -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,Identity

For example: 

Get-InboxRule -Mailbox jason@contoso.com -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward*,Identity

Observe the values of the following properties: 

Get-InboxRule -Identity "<Identity>" -IncludeHidden | Format-List

For example: 

Get-InboxRule -Identity "jason\10210541742734704641" -IncludeHidden | Format-List

For more information, see Control automatic external email forwarding.

Perform an Investigation

When a user reports unusual symptoms, it's crucial to conduct a thorough investigation. The Microsoft Entra admin center and the Microsoft Defender portal provide several tools to help examining suspicious activity on user accounts. Be sure to review the audit logs from the onset of the suspicious activity until you complete the remediation steps.

By analyzing the provided logs, you can pinpoint the specific time frame that requires further attention. Once identified, review the messages sent by the user during this period for more insight.

After the investigation is complete

  1. If you disabled the account during the investigation, reset the password and then enable the account as described earlier in this article
  2. If the account was used to send spam or a high volume of email, it's likely that the mailbox is blocked from sending mail. Remove the user from the Restricted entities page as described in Remove blocked users from the Restricted entities page.

More resources

Detect and Remediate Outlook Rules and Custom Forms Injections Attacks

Detect and Remediate Illicit Consent Grants

Report spam, nonspam, phishing, suspicious email, and files to Microsoft