The Alert Fired at 2:41 AM. Here’s What Happened Next in Two Different SOCs

A business email compromise is in progress at 2:41 AM. The attacker uses a malicious OAuth app to get into a corporate inbox. Your endpoint…