Incident Response - Syne's Cyber Corner

Osprey – An Alternative to the Hawk PowerShell Module for Email Compromise Investigations

By syne0 October 18, 2024

Unfortunately, Hawk is no longer working properly due to the deprecation of the Search-AdminAuditLog cmdlet. The good news is that there is an alternative! Osprey is my fork of Hawk.…

Common Oauth Apps Used in Business Email Compromise

By syne0 August 29, 2024

This article serves as another place to document some common (and not so common) Oauth applications that are abused for malicious purposes during a BEC. Some are well documented, while…

Malicious Usage of eM Client In Business Email Compromise

By syne0 January 31, 2024

If you've found your way to this article, it's likely because you have found a suspicious application content for eM Client. This is an application that is similar in it's…

The Million Dollar CEO Fraud: Anatomy of a Business Email Compromise

By syne0 September 27, 2023

This is the article version of my talk from BSides Edmonton & Calgary 2023. While the actual presentation is probably better, this one can serve as a decent overview. Some…

Gripes About Microsoft Expanding Audit Premium Availability

By syne0 September 13, 2023

The last few blog posts I've made have been more informative or educational, but this is my cybercorner so I will post what I want. I mentioned in my last…

Syne’s Declassified O365 Email Compromise Investigation Guide

By syne0 September 3, 2023

AKA newb's guide to investigating an email compromise. (Yes, I did spend 3x the amount of time making that image then I did writing the article, what about it??) Disclaimer…

Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise

By syne0 July 10, 2023

If you have found your way to this page, you likely discovered a suspicious application consent within your Azure AD tenant for an app called PERFECTDATA SOFTWARE. Concerned, you googled…