Social Engineering (Outbound)

Mandatory security awareness training for employees can help them to recognize a range of cyber attacks that they can play a part in preventing or detecting. This can include topics such as phishing, social engineering, and data classification, amongst others.

Email gateway solutions offer the ability to trace inbound and outbound emails to an organization. This can be used to retrieve information such as emails sent or received, the subject line, content, attachments, timestamps, and recipients.

From the Microsoft Teams admin center, it is possible to review previous Teams meetings or calls that a user account has joined. These logs include key information such as meeting or call ID, start time, duration, and participants. The purpose of this information is to assist with troubleshooting meeting or call issues; however, investigators can use it to determine when user accounts have participated in meetings or calls.

The following URL can be used to view this activity log, provided the investigator's account has the Microsoft Teams Administrator role assigned, or a role with higher privileges: https://admin.teams.microsoft.com/dashboard

Select Users, Manage Users, then the account being investigated. Click on Meetings & Calls, then scroll to the bottom of the page to view the Past Meetings table. Clicking on a meeting or call ID will provide more detailed information.