Social engineering and identity hunting¶

Runbooks for hunting attacker activity in email delivery, identity, and authentication controls: phishing triage and AiTM token theft detection, and hunting for persistence via authentication method changes, mailbox forwarding rules, and OAuth consent grants.