BEC Help Desk Escalation & AiTM Phishing Playbook

⚡ The Anatomy of Modern Phishing & Credential Harvesting

Business Email Compromise (BEC) and credential harvesting remain among the most potent threats to Canadian enterprises. Today’s adversaries rarely rely on simple login pages. Instead, they deploy sophisticated Adversary-in-the-Middle (AiTM) phishing kits like Evilginx or Modlishka. These tools act as reverse proxies, sitting between the victim and the legitimate authentication service.

When a user clicks a malicious link, they are routed through the attacker’s server. This server transparently relays traffic to the real Microsoft Entra ID (formerly Azure AD) or Google Workspace login page. Critically, the AiTM proxy intercepts and captures not just usernames and passwords, but also active session cookies and multi-factor authentication (MFA) tokens. This allows attackers to bypass even robust MFA mechanisms, gaining direct access to the user’s session without needing their password. Once inside, they can initiate financial fraud, data exfiltration, or further lateral movement.

🚨 The 15-Minute First-Responder Runbook for Help Desk & SecOps

When an employee reports clicking a suspicious link or providing credentials, immediate action is paramount. This runbook outlines critical steps within the first 15 minutes to contain the incident and minimize damage.

T+0 to T+2m: Initial Verification & Network Disconnect

1. Verify the Report:
   • Confirm the user’s identity and the nature of the report (e.g., “clicked link,” “entered password,” “noticed strange email”).
   • Ask for the exact URL or email subject if available.
2. Immediate Endpoint Isolation:
   • Instruct the user to immediately disconnect their device from the network (unplug Ethernet, disable Wi-Fi).
   • If remote, use endpoint detection and response (EDR) tools to isolate the affected workstation from the network.
   • Goal: Prevent immediate lateral movement or further compromise from the endpoint.

T+2 to T+5m: Emergency Session Invalidation & Password Reset

1. Invalidate All User Sessions:
   • This is the most critical step to prevent active session hijacking.
   • Connect to Microsoft 365 or Google Workspace admin consoles.
   • PowerShell for Entra ID:

Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"
$UserPrincipalName = "user@yourdomain.com" # Replace with the compromised user's UPN
Revoke-MgUserSignAndSession -UserId (Get-MgUser -Filter "userPrincipalName eq '$UserPrincipalName'").Id

1. Force Password Reset:
   • Immediately force a password reset for the compromised user account.
   • Action: In Entra ID, navigate to the user, select “Reset password.” For Google Workspace, reset the user’s password in the Admin console.
   • Guidance: Instruct the user to create a new, strong, unique password.

T+5 to T+10m: Endpoint Quarantine & Persistence Sweep

1. Quarantine Endpoint:
   • Ensure the affected device remains isolated. If physical access is possible, take it offline.
   • Initiate a full endpoint scan with your EDR/antivirus solution.
2. Mailbox Rule Audit & Removal:
   • Attackers often create inbox rules to forward emails or delete sent items, maintaining persistence and hiding their tracks.
   • PowerShell for Exchange Online:

Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com
$UserMailbox = "user@yourdomain.com" # Replace with the compromised user's email
Get-InboxRule -Mailbox $UserMailbox | ForEach-Object {
Write-Host "Found rule: $($_.Name) - Action: $($_.Description)"
# Review each rule carefully before removal. Remove only suspicious rules.
# Remove-InboxRule -Identity $_.Identity -Mailbox $UserMailbox -Confirm:$false
}

*   **Action:** Manually review each rule. Remove any unfamiliar or suspicious forwarding, deletion, or move rules.

1. Audit OAuth Application Grants:
   • Check for illicit OAuth application grants that could provide persistent access to mailbox, files, or other resources.
   • Action: In Entra ID, navigate to Enterprise applications > User settings > User consent. In Google Workspace, check connected apps for the user. Revoke suspicious grants.

T+10 to T+15m: Incident Documentation & Sign-In Log Review

1. Document the Incident:
   • Create a detailed incident ticket.
   • Record all actions taken, timestamps, and findings.
   • Include user report details, affected systems, and any immediate observations.
2. Review Sign-In Logs:
   • Examine Entra ID sign-in logs or Google Workspace audit logs for the compromised user.
   • Look for:
     • Unusual login locations (geographic anomalies).
     • Login attempts from unknown IP addresses or devices.
     • Successful logins immediately after the reported incident time.
     • Unusual access to sensitive applications.
   • Action: Preserve these logs for forensic analysis.

🔒 Defensive Identity Hardening & Zero Trust Principles

Preventing future BEC and AiTM attacks requires a proactive and layered identity security strategy:

• Phishing-Resistant MFA (FIDO2/Passkeys): Implement FIDO2 security keys or passkeys as the primary authentication method. These are cryptographically bound to the origin website and are inherently resistant to AiTM phishing.
• Entra ID Conditional Access:
  • Authentication Strengths: Enforce specific authentication strengths (e.g., requiring FIDO2 for privileged accounts or access to sensitive applications).
  • Named Locations: Restrict access to corporate resources from known, trusted IP ranges.
  • Compliant Devices: Require devices to be marked as compliant by Intune or other MDM solutions.
• Continuous Access Evaluation (CAE): Enable CAE in Entra ID to provide near real-time revocation of user sessions based on changes in user risk or policy.
• Privileged Access Management (PAM): Implement robust PAM solutions for administrative accounts, enforcing just-in-time access and session monitoring.
• User Training: Regularly educate users on phishing tactics, including the sophistication of AiTM attacks, and the importance of reporting suspicious activity.

Need Urgent IT Assistance or Perimeter Defense?

Is your organization vulnerable to active edge exploits, credential harvesting, or compliance audit penalties? Helpdesk.ca provides 24/7/365 managed IT support, emergency incident triage, and co-managed IT escalation for Canadian enterprises.

• Schedule an IT Discovery Call: Book a 15-Minute Consultation With Our Engineering Team
• Emergency Incident Escalation: Connect directly with our frontline operations desk via Helpdesk.ca Support

Sources & References

• Canadian Centre for Cyber Security: Business Email Compromise
• CISA: Understanding and Mitigating AiTM Phishing
• MITRE ATT&CK: Phishing (T1566)
• Microsoft Learn: Revoke-MgUserSignAndSession
• Microsoft Learn: Get-InboxRule