Skip to main content

Analysis

Documentation for Analysis

📄️ Email & BEC Forensics SOP

Scenario-centric Business Email Compromise forensics: email header forensics (Received-chain reconstruction, Authentication-Results parsing), SPF / DKIM / DMARC / ARC mechanics, lookalike-domain and brand-impersonation detection (IDN homograph, typosquatting, dnstwist patterns, CT-log monitoring), Microsoft 365 Get-MessageTrace and Google Workspace Email Log Search, secure-email-gateway forensics (Mimecast / Proofpoint / Barracuda envelope-vs-header), phishing-kit static analysis (defensive — kit acquisition, telltale strings, AiTM detection), wire-recall pathway (SWIFT MT103 / Fedwire / SEPA recall mechanics, Financial Fraud Kill Chain, FBI IC3 reporting, FinCEN SAR triggers, beneficiary-bank coordination), and BEC scenario taxonomy (CEO fraud, vendor-invoice fraud, payroll-redirect, attorney-impersonation, real-estate / closing-funds, gift-card scam).

📄️ SaaS Log Forensics SOP

SaaS-tenant identity and collaboration plane forensics: Microsoft 365 Unified Audit Log + Purview eDiscovery, Google Workspace Admin SDK Reports + Vault, Okta System Log + Identity Threat Protection, Slack Audit Logs + Discovery API, Salesforce Setup Audit Trail + Real-Time Event Monitoring, GitHub / GitLab audit logs, OAuth consent-grant abuse reconstruction, cross-tenant collaboration forensics (Slack Connect / Workspace external sharing / Entra ID B2B), inbox-rule and mailbox-audit forensics, retention-cliff and discovery-export discipline.