PROFESSIONAL SERVICES

A boutique executive search firm

A hidden two letter mailbox rule was concealing a full account takeover. We found it, proved it, and shut it down in under a day.

A boutique executive search firm nearly lost the one thing its whole business runs on, the trust in its founder's inbox. Here is exactly how the attack worked, the questions we asked, and every PowerShell step we ran to contain it.

Get Results Like TheseRead the Story
From discovery to containment
< 24 hoursFrom discovery to containment
THE CHALLENGE

Where They
Started.

A boutique executive search firm nearly lost the one thing its whole business runs on, the trust in its founder's inbox. Here is exactly how the attack worked, the questions we asked, and every PowerShell step we ran to contain it.

If this sounds like your environment, the first conversation is free and takes 15 minutes.

Book a Free Consultation
THE WORK

What We
Did.

The audit trail told a clean, damning story. The attacker had a valid session, most likely from an earlier adversary in the middle phishing link that stole the sign in token, which is why multifactor authentication never intervened.

01

Step 1. Hunt every inbox rule in the tenant

First we connected to Exchange Online and swept every mailbox for rules that delete, forward, hide, or carry a suspiciously short or blank name. The cx rule lit up on the first pass.

02

Step 2. Preserve the evidence before touching it

Evidence before remediation, always. We dumped the complete definition of every rule in the mailbox to a file, so the attacker's exact configuration is preserved even after we remove it.

03

Step 3. Attribute the rule to an actor, time, and IP

Next we asked the Unified Audit Log who created the rule, when, and from where. This is the command that turned a suspicious setting into proof of intrusion.

04

Step 4. Rebuild the attacker's full footprint from that IP

With the malicious IP confirmed, we pulled every action taken from it, so we could see the whole session rather than a single event.

05

Step 5. Measure the blast radius and rebuild the recipient list

Now the business critical question. Who received the fraud? A message trace gave us the volume spike and, filtered by the lure subject, the exact list of everyone who needed a warning.

06

Step 6. Remove the rule, then verify it is gone

Only after the evidence was preserved did we remove the rule, and we confirmed the removal rather than assuming it.

07

Step 7. Kill the stolen session and hunt an OAuth backdoor

This is the step most people miss. A password reset does not end a session an attacker has already stolen. We switched to Microsoft Graph, revoked every session to kill the stolen token, then checked for any rogue app consent left behind as a way back in.

08

Step 8. Sweep every mailbox to prove isolation

Before we could tell the client they were safe, we had to prove the attacker had not planted the same rule anywhere else. So we swept all 18 mailboxes for attacker style rules.

We'd scope the same kind of engagement for your business, with timelines and effort against each stage.

Get a Scoped PlanCompare Service Levels
You found in one afternoon what we did not even know to look for, and you could prove every word of it. We knew exactly who to call, and we called them the same day.
Managing Partner · an executive search firmA boutique executive search firm
MORE STORIES

Other businesses we've done this for.

View all case studies →
Professional Services

A growing team

The business ran on Google Workspace, and for a while it did the job. As the team grew, the cracks started to show. The owner wanted tighter security. He wanted a proper document structure his people could actually navigate, real collaboration in Teams, and an environment that matched how a serious business runs day to day. The first ask was simple on the surface. Move us to Microsoft 365 Business Premium, and do it without losing anything. The harder part was doing it cleanly. A migration that drops emails, breaks shared files, or locks the team out on Monday morning is worse than no migration at all. He needed it handled by someone who had done it many times, so the switch felt like an upgrade rather than a disruption. That is where we came in. Security felt loose for a business this size. No enforced multi factor, and no real device policy. Files were hard to navigate. There was no document structure people could actually find their way around. Collaboration did not match how a serious business runs. No Teams set up around real workflows. One wrong move could drop emails or break shared files. That fear was holding everything up. A migration that drops data is worse than no migration at all. The owner needed it handled by someone who had done it many times.

ZeroData lost moving off Google Workspace
Professional Services

A professional services firm

The firm had run its email on an aging host for years. The team already lived in Outlook and Office files every day, and everyone agreed the move to Microsoft 365 made sense. One thing kept blocking it, and it was not technical. As the owner put it, losing 19 years of email would be an absolute disaster. They needed to feel completely comfortable before anyone touched the mailboxes. So the whole project was built around a single promise. Nothing at the source would be removed until every mailbox had been checked and verified on the new side. The fear was not the move. It was losing two decades of history that the business runs on every day.

19 yearsOf email moved with zero data loss
Professional Services

A creative agency

The agency had bought Microsoft 365 through GoDaddy when it first set up the business. Over time the cracks showed. They could not reach their own Microsoft 365 admin center to change a thing. Paying for security add ons that were pushed on them, not chosen. Work their licenses should have covered was simply out of reach. Billed every month for a middleman that added cost but no value. In their words, it just felt like a huge scam. They kept asking why they were paying so much when it did not make sense. They wanted out, but one fear stopped them cold. Would they lose their emails or their domain if they disconnected from the reseller?

ZeroRisk to email, files or domain

Want Results Like
This for Your Business?

Book a free 15-minute call. We'll tell you honestly how much of what we did for A boutique executive search firm would apply to your setup.

Book a Free ConsultationContact Us
No commitment
Free 15-min call
500+ clients served