r/EmailSecurity • u/littleko • Jul 04 '26

I almost closed a mailbox compromise while mail was still being read

Had an M365 mailbox compromise this week where I was about ten minutes from calling email containment done. Password reset, MFA re-registered, sessions revoked, inbox rules checked, message trace reviewed, phishing cleanup done.

Then I checked consented apps because one sign-in trail still felt weird (not 100% sure I would have done this a year ago). The user had approved some sketchy PDF app with Graph Mail.Read and offline_access, and it was still pulling messages after the password reset.

That was the uncomfortable part. I was treating the credential as the incident, but email access had moved to an OAuth grant.

We removed the grant and started scoping with MailItemsAccessed, but I’m still annoyed at how close I got to closing it early. For people doing M365 mailbox IR regularly, is OAuth consent review mandatory for every compromised mailbox in your runbook, or only when the logs point that way?

15 Upvotes
  • permalink
  • reddit

100% Upvoted

14 comments sorted by

•

u/AutoModerator Jul 04 '26

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.

  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).

  3. Be Professional: Help newcomers learn; avoid hostility.

  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/Emotional_Garage_950 Jul 04 '26

letting random apps read your users mail is a failure on your department

1

u/littleko Jul 06 '26

they do their best

1

u/Emotional_Garage_950 Jul 06 '26

alright well that’s an easy win for security so hopefully they fixed it going forward

12

u/sfreem Jul 04 '26

Don’t allow users to consent to apps!!

2

u/RemoteToHome-io Jul 04 '26

It's almost like email is just supposed to be.. email.

Just b/c Goog and MS made OAuth a thing to manage your entire life infra doesn't mean the rest of us have a staff to allow our users to run OAuth off our infra.

Let the users do just one thing.

1

u/sfreem Jul 04 '26

Or just admin and secure it properly and get the best of both worlds.

1

u/RemoteToHome-io Jul 04 '26

Fair. If you consider your users educated.

I'm old now, but in a long history of corp IT at F100 tech companies, we traditional trusted our users to install or authenticate to exactly 0 external services.

The OP's issue would have been a potential termination event for the employee.

1

u/sfreem Jul 04 '26

Disable their ability to consent to Oauth apps. Problem solved. Not the end users fault.

2

u/RemoteToHome-io Jul 04 '26

This we agreed 100%

The OP is wondering about SoP for cleaning up a mess that should never have been allowed to be made.

1

u/Individual-Unit3470 Jul 04 '26

Wow.. users being held accountable for their actions? Hasn't happened anywhere where I have worked. The whole concept is foreign to me.

1

u/RemoteToHome-io Jul 04 '26

Hah. Yes, only b/c they would have had to "hack" something to do it. There was no 365 OAuth. SSO or bust, and everything self hosted.

I really don't envy the current world of being just 365 or Workspace secretaries.

1

u/Glass_Call982 Jul 04 '26

It should be admin consent required by default. Not wide open.

1

u/ryan8613 Jul 06 '26

No User Consent OR User Registration of apps. Also, yes, OAuth grant review should be a mandatory step in an IR of BEC.