Investigate Email Account Breach
Budget: ₹100 – ₹400 INR
Unrecognised emails have just gone out from my personal mailbox without my consent. A draft appeared on its own with 401 addresses in CC plus an attachment and, the moment I opened the mailbox, the message was fired off automatically. I need a security-savvy professional to find out what happened, clean it up and tell me exactly how it was done.
Scope of work
• Forensically examine both the mailbox and the local device to confirm whether a script, add-in or remote session triggered the send event.
• Collect and analyse logs (sign-in history, message trace, system and network logs) to pinpoint the origin of the breach and any IPs or accounts involved.
• Remove all malicious code, back-doors or rogue rules that may still be active.
• Harden the account and the device so this cannot recur (configuration review, patch check, MFA, AV scan, etc.).
• Deliver a concise incident report listing findings, steps taken, indicators of compromise and recommendations.
Acceptance criteria
1. A written report that identifies the root cause and, if possible, the attacker’s details or originating IP.
2. Confirmation that no further unauthorised messages can be sent after your remediation steps.
3. Clear, actionable advice for long-term protection.
Tools are your choice—whether that is Wireshark, PowerShell, OSINT platforms or specialised email-forensics utilities—as long as the evidence is preserved and presented clearly.
I’m ready to give you remote access credentials and any additional context you need the moment we start.
Scope of work
• Forensically examine both the mailbox and the local device to confirm whether a script, add-in or remote session triggered the send event.
• Collect and analyse logs (sign-in history, message trace, system and network logs) to pinpoint the origin of the breach and any IPs or accounts involved.
• Remove all malicious code, back-doors or rogue rules that may still be active.
• Harden the account and the device so this cannot recur (configuration review, patch check, MFA, AV scan, etc.).
• Deliver a concise incident report listing findings, steps taken, indicators of compromise and recommendations.
Acceptance criteria
1. A written report that identifies the root cause and, if possible, the attacker’s details or originating IP.
2. Confirmation that no further unauthorised messages can be sent after your remediation steps.
3. Clear, actionable advice for long-term protection.
Tools are your choice—whether that is Wireshark, PowerShell, OSINT platforms or specialised email-forensics utilities—as long as the evidence is preserved and presented clearly.
I’m ready to give you remote access credentials and any additional context you need the moment we start.