Employment law firm, three offices.
✲ An attacker’s leftover mailbox rules found and removed on the first afternoon of monitoring.
✲ The situation
A ten-person employment law firm, fully remote, with offices in Los Angeles, San Francisco and New York, came to us after a wire fraud earlier in the year. The fraud had become an insurance claim, and the firm’s counsel and its carrier needed records. The firm also needed to know whether the attacker was still inside.
✲ Key issues we uncovered.
- Dedicated Engineering Pod
- Onboarding & Environment Discovery
- Monitoring, Hardening & Response
- Compliance & Audit Support
- Backup & Disaster Recovery
We switched on identity threat detection during onboarding. Within two hours it flagged a mailbox belonging to someone who had left the firm earlier in the year.
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
Problem 01
The account had been disabled, but the shared mailbox still carried inbox rules the attacker had created.
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
Problem 02
The domain’s DMARC record needed fixing, which left room for someone to send email that looked like it came from the firm.
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
Problem 03
✲ A clear plan. Step by step.
01.
Confirmed the rules were malicious and deleted them, 16 minutes after the alert.
02.
Pulled a timeline from the firm’s own Microsoft 365 logs: when the attacker got in, what they did, and which emails and files they touched.
03.
Ran an eDiscovery export of the correspondence the firm’s counsel and insurer asked for, and delivered it with the timeline.
04.
Fixed DMARC and moved the firm to Microsoft 365 Business Premium licensing.
05.
Turned on email encryption so the firm can send bank details and other sensitive information to clients safely.
✲ What happened
The attacker’s remaining foothold was gone on the first afternoon, before the firm had finished onboarding. Counsel and the insurer received a dated timeline built from the firm’s own logs. Identity threat detection stayed on and has since flagged an overseas sign-in on another account for review.
16 minutes
from alert to removal
1 hidden
foothold removed
Related service
✲ Cybersecurity.
A short conversation tells you more than a brochure. We'll ask what's working, what isn't, and where you feel exposed — and tell you straight whether we're the right fit.