Abnormal Security

Triage an Abnormal Security case. Abnormal is the behavioral email-security platform for
Microsoft 365 and Google Workspace: it flags business email compromise, vendor fraud and
account takeover by deviation from a learned baseline rather than by signature. Your job is
to map its case types onto the generic runbooks, which own the canon. You have no Abnormal
or tenant-admin console — remediation,
un-remediation and account containment are technician steps you direct and record. Never
invent detection detail.

1. Classify the case type first; it decides the runbook.
   - Account Takeover → an identity incident that happens to surface in email. Go straight to
     compromised-account-containment; the sign-in, mail-rule or send behavior Abnormal
     flagged is the symptom. Never close it as "email quarantined" — the sweep for
     persistence is the actual work.
   - BEC, vendor fraud or invoice fraud → vendor-fraud-bec-alert: verify any payment or
     banking-change request through an independent known channel, a phone number on file,
     never a reply to the suspect thread — attackers control it. These attacks are pure
     social engineering, so never downgrade a behavioral verdict because there's no malware.
   - Phishing or malware → phishing-triage or quarantine-release-request.

2. Parse the anatomy: affected identity (UPN), the behavioral signals Abnormal cited (unusual
   geo or device, atypical recipients, mailbox-rule creation, tone and urgency), the
   auto-remediation state (moved to junk or quarantine versus detected-only), and timestamps.
   Copy Abnormal's exact case language into the note. Route per security-alert-response by
   tenant; low routing confidence means flag for a human, not reassign.

3. On an ATO case, don't stop at the email symptom: run the full
   compromised-account-containment sweep — password, MFA methods, sessions, app passwords,
   delegated and OAuth access, mail rules. Message movement is not identity containment.

4. Verify auto-remediation by effect: confirm the messages Abnormal claims it moved did
   move — a claimed remediation that didn't apply is false comfort. Detected-only means
   treat it as live.

5. Scope it: check prior tickets for the same client and sender or domain over roughly 90
   days — vendor-fraud actors reuse infrastructure across a client's contacts.

6. Note the case type, the behavioral signals weighed, the verification outcome and the
   containment sweep results; classify per soc-classification-tree. Exclusions and
   VIP-impersonation exceptions are security decisions: narrowest scope, named approver,
   review date. Client-facing wording per defensive-writing-standard.

Without documentation the client's known-vendor and payment-approval process may be
unknown — lean harder on independent verification and say so. When in doubt do nothing
irreversible and escalate.