Malicious inbox rules
Rules moving replies to RSS Subscriptions, Junk, or hidden folders. Classic BEC staging. Surfaced within minutes of creation.
SERVICE · M365 MDR
The stuff that
The stuff that
actually
kills SMBs.
Microsoft 365 Managed Detection and Response (MDR) for UK SMBs
It's almost never a zero-day. It's an inbox rule sending supplier replies to RSS Subscriptions. A forwarder nobody noticed. A malicious OAuth grant approved three months ago. Managed Detection & Response for Microsoft 365, built for how SMBs actually get compromised.
Defender for O365
Huntress
BEC-focused
OAuth hygiene
01 / WHAT IT WATCHES
Six ways your
Six ways your
tenancy gets
quietly owned.
The top detections that pay for MDR every single month. None of them are glamorous. All of them are common.
Rogue forwarders
Mail auto-forwarded to external addresses. Often configured during a brief compromise window and forgotten for months.
OAuth consent abuse
Enterprise apps granted invasive permissions. Third-party consent phishing. Revoked and reported.
Risky sharing & access
SharePoint/OneDrive mass-share events, Teams external guest spikes, anonymous link creation on sensitive sites.
Admin-surface drift
New Global Admins, Conditional Access policy tampering, break-glass account use, dormant admins waking up.
Defender signal fusion
Defender for O365, Identity and Endpoint signals correlated into one SOC view. One alert, not six.
02 / HOW WE RUN IT
Baseline. Watch.
Baseline. Watch.
Hunt. Report.
- STEP 01
Baseline
2-day tenancy audit. Existing OAuth grants reviewed, dormant admins flagged, forwarders inventoried, inbox-rule register captured. The "before" picture.
- OAuth inventory
- Admin register
- Rule inventory
- STEP 02
Watch
Detection pack deployed. Defender policies tuned. Alerts piped to SOC. Auto-response rules pre-authorised for the high-volume, low-risk actions (rule delete, forwarder remove, session revoke).
- Detection pack
- Defender tuning
- Auto-response live
- STEP 03
Hunt
Monthly threat hunts — OAuth drift, sharing anomalies, impossible travel clusters, risky apps. Findings categorised, triaged, remediated.
- Monthly hunt
- Findings register
- Remediation plan
- STEP 04
Report
Plain-English monthly report: incidents, near-misses, posture drift, what changed, what to approve. The thing you'd actually read in a board meeting.
- Monthly report
- Posture score
- Board-grade summary
03 / WHY IT MATTERS
BEC isn't
BEC isn't
a malware problem.
It's a config
problem.
The biggest financial losses SMBs see from cyber aren't ransomware — they're invoice fraud and CEO fraud, enabled by small, quiet changes to a mailbox weeks before the attack happens. Managed MDR for M365 watches those quiet changes so they surface before the money moves.
- ✓BEC staging caughtInbox rules and forwarders triggered as they're created, not discovered after the incident.
- ✓OAuth hygieneEnterprise apps reviewed and revoked. Consent phishing closed off.
- ✓Admin drift stoppedPrivilege creep surfaces monthly. Dormant Global Admins don't stay dormant by accident.
- ✓Board-grade reportingPlain English, posture score, one page. No 40-slide portal tour.
04 / FAQ
Questions
Questions
we hear a lot.
How does M365 MDR differ from ITDR?
ITDR focuses on identity. M365 MDR goes deeper into the tenancy — mailbox-level persistence, SharePoint access patterns, Teams guest abuse, Defender for O365 alerts. We run both; they share the same SOC and the same response.
Do we need an E5 licence?
No. MDR works across Business Premium upwards. E5 gives us richer telemetry, but most detections we rely on — mailbox rules, OAuth, audit log, sign-in risk — are available at Business Premium.
What kinds of BEC does it catch?
Most common patterns: invoice fraud preparation (rules that hide replies to the attacker), payroll fraud (forwarders to external), supplier impersonation (lookalike domains), and delegated mailbox abuse.
Can it auto-remediate?
Yes, for pre-authorised actions: disable rules, remove forwarders, revoke OAuth grants, kill sessions, disable accounts. Higher-impact actions (removing mail, blocking domains) are SOC-human confirmed.
What about Copilot and AI telemetry?
Copilot interactions are monitored through the M365 audit log. Unusual queries, access attempts to sensitive sites, and abnormal prompt volumes all surface. Policy guidance included.
Do we still need email security on top?
Yes. MDR catches post-delivery compromise. Email security catches pre-delivery — phishing, BEC, malware attachments, impersonation. Both layers, same SOC.
RELATED SERVICES
Often runs with.
01
Managed ITDR
The identity layer. Token theft, MFA fatigue, sign-in anomalies. Same SOC, correlated detections.
Read more 02Email security
Pre-delivery layer. Phishing, BEC, impersonation, attachment sandboxing, DMARC enforcement.
Read more 03M365 Managed Services
MDR runs best on a well-run tenancy. Day-to-day management of M365, Entra and endpoints.
Read more
NEXT STEP
Free tenancy
Free tenancy
posture review.
30-minute read-only audit of your M365. You'll see the OAuth grants, risky forwarders and admin drift you almost certainly have. Whether or not you hire us.