On March 3rd, 2026 at 09:17 AM, a Finance department employee at ABC Manufacturing Ltd clicked a malicious link in a spoofed Microsoft IT Support email — subject: "Action Required: Verify Your Mailbox Storage Immediately." The link redirected to a credential harvesting page mimicking Microsoft 365. Within 20 minutes, the SOC detected both failed and successful authentication attempts from foreign IP addresses, indicating credentials had been harvested and were actively being used.
L1 Triage: Reviewed SIEM Impossible Travel alert. Pulled Azure AD sign-in logs — confirmed successful login from 185.220.101.47. Reviewed email logs — identified spoofed phishing email at 09:10 AM. Checked mailbox for forwarding rules — found active auto-forward to external address. Confirmed True Positive (TP). Escalated to L2 with full evidence package.
L2 Remediation: Disabled compromised M365 account and revoked sessions. Removed malicious forwarding rule. Blocked attacker IPs at firewall and Defender for Endpoint. Added phishing domain to email gateway blocklist. Conducted mailbox audit for exfiltration window (09:19–09:52 AM). Forced password reset + MFA enrolment. Notified Finance manager and DPO. Threat hunted all Finance accounts for same IOCs.
The primary root cause was the absence of MFA on the Finance employee's account, allowing the attacker unrestricted access using only harvested credentials. Combined with missing email security filtering and insufficient user awareness, the attack succeeded with minimal technical sophistication. SOC detection via the SIEM Impossible Travel alert — 20 minutes after initial compromise — enabled rapid containment within 68 minutes. Implementation of MFA alone would have prevented this incident entirely.
Analyst: O.T. Nathaniel, AMICDFA, CCEP, CBTP, CTIGA | NexSecure Bootcamp | March 2026