Introduction

"Come on, I only clicked a link."

This phrase is operationally expensive. A single click can trigger an incident response pipeline that consumes hours of forensic work, identity containment, endpoint triage, and communications management.

This is the story of exactly that scenario—a trusted SharePoint link, a quick click, and the investigation that followed.

Note: This is a real incident. All identifying details have been anonymized.

The Incident: How It Started

A client contacted us reporting the following sequence:

  • Day 1: The user clicked a link that appeared legitimate—a SharePoint sharing notification received by email from a known business contact.
  • Immediately after: The link didn't show obvious content. "Nothing appeared," the user reported.
  • Hours later: The user's entire address book began receiving emails that looked like SharePoint sharing notifications, seemingly originating from the user's account.
  • Confirmation: The original sender later confirmed that their own Microsoft 365 account had been compromised and used to send phishing emails to their contacts.

The question: Was our client's Microsoft 365 identity now compromised? Was the workstation infected?

Working Hypotheses: What We Assumed Until Proven Otherwise

We treated this as high-risk with four concurrent hypotheses:

  1. Mailbox takeover / token theft — Attacker gained access via stolen credentials, session cookies, or OAuth consent abuse
  2. Tenant-level exposure — If the user has elevated privileges, the blast radius extends to the entire M365 tenant
  3. Mailbox rule abuse — Attacker creates rules to auto-delete security alerts and hide evidence
  4. Endpoint compromise — The click may have resulted in malware execution or credential harvesting

The Investigation: What We Did

Endpoint Triage

We ran rapid triage focused on:

  • Active outbound connections
  • Process-to-connection mapping
  • Digital signature validation of executables
  • Suspicious scripts in temp locations

Key Finding: A cluster of suspicious-looking processes and outbound connections were traced to Acronis backup agent components—digitally signed, legitimate software running as expected services. What initially looked alarming was actually normal backup infrastructure.

This is why validation matters. Not everything suspicious is malicious.

Mailbox Forensics: The Red Flag

Within Outlook Web Access, we discovered an inbox rule that:

  • Matched a large list of "spammy" keywords
  • Marked matching messages as read
  • Deleted them automatically

Why this matters:

This is a classic persistence and stealth tactic in Business Email Compromise (BEC). The rule:

  • Hides security notifications
  • Suppresses victim replies
  • Deletes phishing bouncebacks
  • Obscures "recall" attempts

The rule operates server-side—it doesn't require the user to open the email. It executes automatically on message arrival.

This was our smoking gun. The presence of this rule strongly indicated compromise had already occurred.

What We Secured

Endpoint level:

  • Mapped suspicious traffic to legitimate, signed Acronis processes
  • Captured baseline hashes for future integrity verification
  • No malware indicators found in this snapshot

Mailbox level:

  • Confirmed presence of attacker-planted inbox rules
  • Documented the compromise indicator for further investigation

What We Could NOT Confirm

Real-world incident response has limitations:

  • No EDR telemetry — Without Microsoft Defender for Endpoint or SIEM, we couldn't reconstruct the full process execution chain
  • M365 audit log access — Tenant visibility depends on logging configuration and access rights
  • One clean slice ≠ full clearance — Confirming one component is benign doesn't clear the entire environment

The Incident Response Playbook

Priority A: Contain Identity Risk (Do This First)

  • Revoke all sessions/tokens immediately
  • Reset password to a strong, unique value
  • Enforce MFA — preferably phishing-resistant (FIDO2/Authenticator with number matching)
  • Review and remove malicious inbox rules — including "hidden" rules
  • Check for mail forwarding — mailbox-level and tenant-level transport rules
  • Audit Entra ID sign-in logs — look for impossible travel, unusual IPs, legacy auth
  • Review OAuth app consents — remove unknown enterprise apps with suspicious permissions

Priority B: Validate Endpoint

  • Run offline/secondary antimalware scans
  • Review persistence points (startup, scheduled tasks, services, WMI)
  • Clear browser sessions and review extensions
  • Re-authenticate only after token revocation

Priority C: Communications

  • Notify affected recipients that phishing was sent from the compromised account
  • Advise: "Do not click. If you clicked, reset credentials immediately."
  • Review SPF/DKIM/DMARC configuration

What We Believe Happened

The attack chain:

  1. A trusted contact's M365 account was compromised
  2. Attackers used it to send legitimate-looking SharePoint emails to the contact list
  3. Our client clicked the link
  4. The click likely harvested credentials or session tokens
  5. Attackers immediately planted inbox rules to hide their activity
  6. The compromised account began sending phishing to the next wave of victims

This is the viral nature of BEC attacks—each compromised account becomes the launchpad for the next.

Protection Guide: Before and After the Click

Before You Click

  • Treat "SharePoint/OneDrive shared file" emails as hostile until verified
  • Verify the sender out-of-band (call or message them directly)
  • Hover and inspect: domain spelling, unexpected redirects, shortened URLs
  • If the email claims urgency or secrecy, assume phishing

If You Clicked

  • Report immediately—do not "wait to see"
  • Change password and revoke sessions as instructed
  • Do not approve unexpected MFA prompts
  • Assume compromise until proven otherwise

Email Hygiene

  • Keep external images off by default
  • Never reuse passwords across services
  • Use a password manager with unique passwords per service

The Bottom Line

A single click triggered:

  • Identity containment (session revocation, password reset, MFA enforcement)
  • Mailbox forensics (rules, forwarding, OAuth apps, sign-in logs)
  • Endpoint triage (process mapping, signature validation, hash baselining)
  • Communications and reputation control
  • Preventive hardening recommendations

Even when "nothing happened" on screen, the real damage was invisible: hidden mail rules, potential token theft, and a compromised account ready to attack the next wave of victims.

The phrase "I only clicked a link" is the most expensive sentence in IT.

Need Help With Incident Response?

If you've experienced a similar incident—or want to prevent one—IWH provides:

  • Incident response and forensic triage
  • Microsoft 365 security hardening
  • Phishing simulation and awareness training
  • Email security configuration (SPF/DKIM/DMARC, inbox rule monitoring)

Contact us for a security assessment