Business Email Compromise - Syne's Cyber Corner

Osprey – An Alternative to the Hawk PowerShell Module for Email Compromise Investigations

By syne0 October 18, 2024

Unfortunately, Hawk is no longer working properly due to the deprecation of the Search-AdminAuditLog cmdlet. The good news is that there is an alternative! Osprey is my fork of Hawk.…

Common Oauth Apps Used in Business Email Compromise

By syne0 August 29, 2024

This article serves as another place to document some common (and not so common) Oauth applications that are abused for malicious purposes during a BEC. Some are well documented, while…

Malicious Usage of eM Client In Business Email Compromise

By syne0 January 31, 2024

If you've found your way to this article, it's likely because you have found a suspicious application content for eM Client. This is an application that is similar in it's…