Financial Theft — BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable

let Lookback = 14d;
let CorrelationWindow = 48h;
let PaymentKeywords = dynamic(["invoice", "remittance", "wire transfer", "bank details", "account number", "routing number", "payment instructions", "iban", "swift", "ach", "updated banking", "new bank"]);
let FinanceRecipients = dynamic(["ap@", "accountspayable@", "accounts.payable@", "finance@", "payments@", "treasury@"]);
let SuspiciousRules = OfficeActivity
| where TimeGenerated > ago(Lookback)
| where OfficeWorkload == "Exchange"
| where Operation in ("New-InboxRule", "Set-InboxRule")
| extend ParamText = tostring(Parameters)
| where ParamText has_any ("MoveToFolder", "DeleteMessage", "Delete")
| where ParamText has_any (PaymentKeywords)
| extend MailboxOwner = tolower(tostring(UserId))
| project RuleTime = TimeGenerated, MailboxOwner, ParamText, ClientIP;
EmailEvents
| where TimeGenerated > ago(Lookback)
| where Subject has_any (PaymentKeywords)
| extend SenderLower = tolower(SenderFromAddress)
| where RecipientEmailAddress has_any (FinanceRecipients)
| join kind=inner (SuspiciousRules) on $left.SenderLower == $right.MailboxOwner
| where (TimeGenerated - RuleTime) between (0min .. CorrelationWindow)
| project TimeGenerated, SenderFromAddress, RecipientEmailAddress, Subject, RuleTime, ParamText, ClientIP
| sort by TimeGenerated desc

index=o365 sourcetype="o365:management:activity" Workload=Exchange (Operation="New-InboxRule" OR Operation="Set-InboxRule")
| eval ParamText=Parameters
| where match(ParamText, "(?i)(MoveToFolder|DeleteMessage|Delete)") AND match(ParamText, "(?i)(invoice|remittance|wire transfer|bank details|account number|routing number|payment instructions|iban|swift|ach|updated banking|new bank)")
| eval MailboxOwner=lower(UserId)
| eval RuleTime=_time
| table RuleTime MailboxOwner ParamText ClientIP
| join type=inner MailboxOwner
    [ search index=o365 sourcetype="o365:office365:email" (Subject="*invoice*" OR Subject="*remittance*" OR Subject="*wire transfer*" OR Subject="*bank details*" OR Subject="*payment instructions*" OR Subject="*routing number*")
      (RecipientEmailAddress="ap@*" OR RecipientEmailAddress="accountspayable@*" OR RecipientEmailAddress="finance@*" OR RecipientEmailAddress="payments@*" OR RecipientEmailAddress="treasury@*")
    | eval MailboxOwner=lower(SenderFromAddress)
    | table _time MailboxOwner SenderFromAddress RecipientEmailAddress Subject ]
| where (_time - RuleTime) >= 0 AND (_time - RuleTime) <= 172800
| sort - _time

sequence by user.email with maxspan=48h
  [any where event.dataset == "o365.audit" and event.action : ("New-InboxRule", "Set-InboxRule") and o365.audit.Parameters : ("*MoveToFolder*", "*DeleteMessage*") and o365.audit.Parameters : ("*invoice*", "*payment*", "*bank*", "*wire*")]
  [any where event.dataset == "o365.audit" and event.action == "MailItemsAccessed" or event.dataset == "o365.exchange" and message.subject : ("*invoice*", "*wire transfer*", "*bank details*", "*routing number*")]

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  "Event Name" AS OperationName,
  "User Id" AS MailboxOwner,
  UTF8(payload) AS ParamText
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) ILIKE '%Office 365%'
  AND "Event Name" IN ('New-InboxRule', 'Set-InboxRule')
  AND (UTF8(payload) ILIKE '%MoveToFolder%' OR UTF8(payload) ILIKE '%DeleteMessage%')
  AND (UTF8(payload) ILIKE '%invoice%' OR UTF8(payload) ILIKE '%payment%' OR UTF8(payload) ILIKE '%bank%' OR UTF8(payload) ILIKE '%wire%')
ORDER BY starttime DESC
LAST 14 DAYS

_sourceCategory="o365/management/exchange"
operationName in ("New-InboxRule", "Set-InboxRule")
| json field=_raw "UserId" as MailboxOwner nodrop
| json field=_raw "Parameters" as ParamText nodrop
| where ParamText matches "*MoveToFolder*" or ParamText matches "*DeleteMessage*"
| where ParamText matches "*invoice*" or ParamText matches "*payment*" or ParamText matches "*bank*" or ParamText matches "*wire*"
| eval RuleTime=_messagetime
| eval MailboxOwner=tolower(MailboxOwner)
| join type=inner MailboxOwner
    [ _sourceCategory="o365/exchange/mailflow"
      (subject matches "*invoice*" or subject matches "*wire transfer*" or subject matches "*bank details*")
      (recipient matches "ap@*" or recipient matches "accountspayable@*" or recipient matches "finance@*")
    | json field=_raw "SenderFromAddress" as SenderFromAddress
    | eval MailboxOwner=tolower(SenderFromAddress) ]
| where (_messagetime - RuleTime) >= 0 and (_messagetime - RuleTime) <= 172800000
| sort by _messagetime desc

rule bec_invoice_redirect_wire_fraud {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects an Exchange inbox rule that hides payment/invoice replies followed by a payment-redirect email from the same mailbox to a finance/AP recipient"
    reference = "https://attack.mitre.org/techniques/T1657/"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1657"
    false_positives = "Legitimate AP folder-routing rules, verified vendor banking updates, shared support mailbox triage rules, bulk mailbox migrations"
    version = "1.0"

  events:
    $rule.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $rule.metadata.product_name = "Office 365"
    $rule.target.resource.attribute.labels["OperationName"] in %inbox_rule_operations
    $rule.principal.user.email_addresses = $mailbox

    $mail.metadata.event_type = "EMAIL_TRANSACTION"
    $mail.metadata.product_name = "Office 365"
    $mail.principal.user.email_addresses = $mailbox
    $mail.network.email.subject = $subject

  match:
    $mailbox over 48h

  condition:
    $rule and $mail
}

#repo=o365_audit
(#event.name="New-InboxRule" OR #event.name="Set-InboxRule")
Parameters=/(?i)(MoveToFolder|DeleteMessage)/
Parameters=/(?i)(invoice|payment|bank|wire)/
| MailboxOwner := lower(UserId)
| RuleTime := "@timestamp"
| join(query={#repo=o365_mailflow Subject=/(?i)(invoice|wire transfer|bank details|routing number)/ RecipientEmailAddress=/(?i)^(ap|accountspayable|finance|payments|treasury)@/ | MailboxOwner := lower(SenderFromAddress)}, field=[MailboxOwner], key=[MailboxOwner])
| test(@timestamp - RuleTime >= 0 && @timestamp - RuleTime <= 172800)
| sort(@timestamp, order=desc)