Detect BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable in CrowdStrike LogScale

Business Email Compromise crews executing invoice-redirect wire fraud follow a consistent two-step pattern once they have obtained credentials or an active session for a vendor-facing or internal finance mailbox (typically via phishing, MFA fatigue, or token theft — see THREAT-BEC-OAuthDeviceCode for the initial-access variant). First, the attacker creates or modifies an Exchange inbox rule that silently moves or deletes incoming messages containing invoice/payment-related keywords into Deleted Items, RSS Feeds/Subscriptions, or an obscure archive folder, so the legitimate mailbox owner never sees replies, confirmation calls, or the real vendor's follow-up correspondence about the transaction in flight. Second, from that same compromised mailbox (or a lookalike domain impersonating it), the attacker sends or replies to an active invoice/payment thread with 'updated' banking details — a new account number, routing number, or IBAN/SWIFT code — asking accounts payable or a customer to redirect an upcoming wire transfer. Individually, a new inbox rule or a payment-detail-change email can look mundane; the correlation of a hiding-behavior rule (move-to-folder or delete, scoped to invoice/payment terms) created on a mailbox, followed within a short window by an outbound email from that same mailbox to an accounts-payable/finance alias referencing altered banking instructions, is a high-fidelity indicator of active invoice-redirect fraud rather than routine mailbox housekeeping. Detection correlates Exchange admin audit events (New-InboxRule/Set-InboxRule in OfficeActivity) with Microsoft Defender for Office 365 mail flow telemetry (EmailEvents) for the same sending identity.