Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-BEC-InvoiceRedirectWireFraud.
Upgrade to ProFinancial Theft — BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable
Business Email Compromise crews executing invoice-redirect wire fraud follow a consistent two-step pattern once they have obtained credentials or an active session for a vendor-facing or internal finance mailbox (typically via phishing, MFA fatigue, or token theft — see THREAT-BEC-OAuthDeviceCode for the initial-access variant). First, the attacker creates or modifies an Exchange inbox rule that silently moves or deletes incoming messages containing invoice/payment-related keywords into Deleted Items, RSS Feeds/Subscriptions, or an obscure archive folder, so the legitimate mailbox owner never sees replies, confirmation calls, or the real vendor's follow-up correspondence about the transaction in flight. Second, from that same compromised mailbox (or a lookalike domain impersonating it), the attacker sends or replies to an active invoice/payment thread with 'updated' banking details — a new account number, routing number, or IBAN/SWIFT code — asking accounts payable or a customer to redirect an upcoming wire transfer. Individually, a new inbox rule or a payment-detail-change email can look mundane; the correlation of a hiding-behavior rule (move-to-folder or delete, scoped to invoice/payment terms) created on a mailbox, followed within a short window by an outbound email from that same mailbox to an accounts-payable/finance alias referencing altered banking instructions, is a high-fidelity indicator of active invoice-redirect fraud rather than routine mailbox housekeeping. Detection correlates Exchange admin audit events (New-InboxRule/Set-InboxRule in OfficeActivity) with Microsoft Defender for Office 365 mail flow telemetry (EmailEvents) for the same sending identity.
What is THREAT-BEC-InvoiceRedirectWireFraud BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable?
BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable (THREAT-BEC-InvoiceRedirectWireFraud) is a sub-technique of Financial Theft (T1657) in the MITRE ATT&CK framework. It maps to the Impact tactic — the adversary is trying to manipulate, interrupt, or destroy your systems and data.
This page provides production-ready detection logic for BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable, covering the data sources and telemetry it touches: Microsoft 365 Unified Audit Log (Exchange admin audit events), Microsoft Defender for Office 365 (EmailEvents advanced hunting table), Microsoft Sentinel OfficeActivity table. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Impact
let Lookback = 14d;
let CorrelationWindow = 48h;
let PaymentKeywords = dynamic(["invoice", "remittance", "wire transfer", "bank details", "account number", "routing number", "payment instructions", "iban", "swift", "ach", "updated banking", "new bank"]);
let FinanceRecipients = dynamic(["ap@", "accountspayable@", "accounts.payable@", "finance@", "payments@", "treasury@"]);
let SuspiciousRules = OfficeActivity
| where TimeGenerated > ago(Lookback)
| where OfficeWorkload == "Exchange"
| where Operation in ("New-InboxRule", "Set-InboxRule")
| extend ParamText = tostring(Parameters)
| where ParamText has_any ("MoveToFolder", "DeleteMessage", "Delete")
| where ParamText has_any (PaymentKeywords)
| extend MailboxOwner = tolower(tostring(UserId))
| project RuleTime = TimeGenerated, MailboxOwner, ParamText, ClientIP;
EmailEvents
| where TimeGenerated > ago(Lookback)
| where Subject has_any (PaymentKeywords)
| extend SenderLower = tolower(SenderFromAddress)
| where RecipientEmailAddress has_any (FinanceRecipients)
| join kind=inner (SuspiciousRules) on $left.SenderLower == $right.MailboxOwner
| where (TimeGenerated - RuleTime) between (0min .. CorrelationWindow)
| project TimeGenerated, SenderFromAddress, RecipientEmailAddress, Subject, RuleTime, ParamText, ClientIP
| sort by TimeGenerated descJoins Exchange admin audit events (OfficeActivity, Operation in New-InboxRule/Set-InboxRule) where the rule's action moves-to-folder or deletes messages AND the rule's conditions target invoice/payment keywords, against outbound mail from that same mailbox (EmailEvents) sent to an accounts-payable/finance-style recipient with a subject referencing invoice, banking, or payment-instruction language. A match within 48 hours of the rule's creation indicates the mailbox owner concealed inbound correspondence about the exact transaction they then used to solicit a payment redirect — the defining signature of invoice-redirect BEC rather than two unrelated benign events.
Data Sources
Required Tables
False Positives
- Legitimate finance/vendor-management inbox rules that route invoice emails into a dedicated 'AP Processing' or 'Invoices' folder as part of normal workflow automation, rather than to Deleted Items, RSS Feeds/Subscriptions, or Archive
- A real vendor legitimately updating its banking details through an authorized annual vendor-refresh or procurement onboarding campaign, verified out-of-band before the correlated rule was created for an unrelated reason
- A shared support/ticketing mailbox with a rule that moves messages containing 'payment' or 'invoice' into a triage folder for a helpdesk team, combined with an unrelated automated billing-system notification to a finance alias
- IT-driven mailbox migration or retention-policy cleanup that creates bulk move-to-folder rules referencing generic keyword sets across many mailboxes at once, including some that overlap with payment terminology
Sigma rule & cross-platform mapping
The detection logic for BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable (THREAT-BEC-InvoiceRedirectWireFraud) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
product: azureBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for THREAT-BEC-InvoiceRedirectWireFraud
References (6)
- https://attack.mitre.org/techniques/T1657/
- https://attack.mitre.org/tactics/TA0040/
- https://www.ic3.gov/Media/Y2023/PSA230609
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack
- https://learn.microsoft.com/en-us/defender-office-365/advanced-hunting-emailevents-table
- https://learn.microsoft.com/en-us/powershell/module/exchange/new-inboxrule
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Hiding Inbox Rule Scoped to Payment Keywords
Expected signal: OfficeActivity entry with Operation='New-InboxRule', OfficeWorkload='Exchange', UserId matching the test mailbox, and Parameters JSON containing MoveToFolder targeting 'Deleted Items' plus the SubjectOrBodyContainsWords condition list.
- Test 2Simulate Fraudulent Payment-Redirect Email to Test AP Alias
Expected signal: EmailEvents entry with SenderFromAddress matching the test mailbox, RecipientEmailAddress matching the test AP alias, and Subject/body containing payment-instruction and banking-detail keywords.
- Test 3Simulate Full Chained Sequence Within Correlation Window
Expected signal: An OfficeActivity New-InboxRule entry immediately followed by an EmailEvents entry from the same mailbox to the test AP alias, both within seconds to minutes of each other.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-BEC-InvoiceRedirectWireFraud — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month