>BEC Checker

Investigating a suspected Business Email Compromise? Enter the account's email address (UPN) and, as your investigation progresses, flag the IPs, malicious senders and phishing URLs you find. Every hunt query below updates live and narrows to them. Pick your hunting platform, Microsoft Defender XDR (Advanced Hunting, Timestamp) or Microsoft Sentinel (Log Analytics, TimeGenerated), and the queries rewrite themselves with the right table and column names. It starts from what Microsoft already alerted on, then covers access-origin triage, the lure that started it, mail objectives, OAuth consent phishing, and attacker device-code / device & MFA registration persistence; the portal steps cover what KQL can't reach. Nothing is sent anywhere: this all runs in your browser. Powered by the >SudoTrace BEC module.