Pashupatastra

The alert

this is all you get to start with

warningasset:m.okafor-mailbox11d ago

message from rn1crosoft-billing.com delivered to m.okafor

Investigate

0 of 3 opened

Open what you would look at. One of the explanations below is plausible and wrong, and something here rules it out.

What happened?

50 points

The account's password was compromised and used to sign in.A phishing link led to an OAuth consent, and the resulting token — not a password — is what read the mailbox.

What would you do about it?

30 points

Proportionality is scored. Doing too little and doing too much are both wrong, and one of these would do far too much.

Read logs for an entityread_logsrisk 0changes nothingNotify or page a security analystnotify_analystrisk 0Open a case for the incidentcreate_caserisk 0Force re-authentication with a second factorrequire_mfa_reauthrisk 10Lift a step-up authentication requirementclear_mfa_requirementrisk 10Invalidate an active session or tokenrevoke_sessionrisk 25Isolate a message from every recipient's mailboxquarantine_emailrisk 25Erase a hostwipe_hostrisk 100

The alert

this is all you get to start with

warningasset:m.okafor-mailbox11d ago

message from rn1crosoft-billing.com delivered to m.okafor

Investigate

0 of 3 opened

Open what you would look at. One of the explanations below is plausible and wrong, and something here rules it out.

What happened?

50 points

The account's password was compromised and used to sign in.A phishing link led to an OAuth consent, and the resulting token — not a password — is what read the mailbox.

What would you do about it?

30 points

Proportionality is scored. Doing too little and doing too much are both wrong, and one of these would do far too much.

INC-2026-0902

The alert

Investigate

What happened?

What would you do about it?

INC-2026-0902

The alert

Investigate

What happened?

What would you do about it?