Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-BEC-InvoiceRedirectWireFraud.
Upgrade to ProDetect BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable in IBM QRadar
Business Email Compromise crews executing invoice-redirect wire fraud follow a consistent two-step pattern once they have obtained credentials or an active session for a vendor-facing or internal finance mailbox (typically via phishing, MFA fatigue, or token theft — see THREAT-BEC-OAuthDeviceCode for the initial-access variant). First, the attacker creates or modifies an Exchange inbox rule that silently moves or deletes incoming messages containing invoice/payment-related keywords into Deleted Items, RSS Feeds/Subscriptions, or an obscure archive folder, so the legitimate mailbox owner never sees replies, confirmation calls, or the real vendor's follow-up correspondence about the transaction in flight. Second, from that same compromised mailbox (or a lookalike domain impersonating it), the attacker sends or replies to an active invoice/payment thread with 'updated' banking details — a new account number, routing number, or IBAN/SWIFT code — asking accounts payable or a customer to redirect an upcoming wire transfer. Individually, a new inbox rule or a payment-detail-change email can look mundane; the correlation of a hiding-behavior rule (move-to-folder or delete, scoped to invoice/payment terms) created on a mailbox, followed within a short window by an outbound email from that same mailbox to an accounts-payable/finance alias referencing altered banking instructions, is a high-fidelity indicator of active invoice-redirect fraud rather than routine mailbox housekeeping. Detection correlates Exchange admin audit events (New-InboxRule/Set-InboxRule in OfficeActivity) with Microsoft Defender for Office 365 mail flow telemetry (EmailEvents) for the same sending identity.
MITRE ATT&CK
- Tactic
- Impact
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
"Event Name" AS OperationName,
"User Id" AS MailboxOwner,
UTF8(payload) AS ParamText
FROM events
WHERE
LOGSOURCETYPENAME(logsourceid) ILIKE '%Office 365%'
AND "Event Name" IN ('New-InboxRule', 'Set-InboxRule')
AND (UTF8(payload) ILIKE '%MoveToFolder%' OR UTF8(payload) ILIKE '%DeleteMessage%')
AND (UTF8(payload) ILIKE '%invoice%' OR UTF8(payload) ILIKE '%payment%' OR UTF8(payload) ILIKE '%bank%' OR UTF8(payload) ILIKE '%wire%')
ORDER BY starttime DESC
LAST 14 DAYSQRadar AQL query over Office 365 Exchange admin audit events ingested via the QRadar Microsoft 365 DSM or Universal Cloud REST API log source. Returns candidate hiding-behavior inbox rules scoped to payment keywords. Build a QRadar rule that joins this result set against a second AQL search over mail-flow events (Office 365 EmailEvents equivalent, if licensed/ingested) for the same MailboxOwner within a 48-hour window and a finance/AP recipient pattern, reproducing the full KQL/SPL correlation — QRadar's Custom Rule Engine reference-set join is generally the practical mechanism for this cross-event correlation rather than a single AQL statement.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate finance/vendor-management inbox rules routing invoice emails into a dedicated processing folder
- Authorized vendor banking-detail refresh verified out-of-band
- Shared support/ticketing mailbox rules triaging payment-related messages
- Bulk IT-driven mailbox migration or retention-policy rule creation
Other platforms for THREAT-BEC-InvoiceRedirectWireFraud
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Hiding Inbox Rule Scoped to Payment Keywords
Expected signal: OfficeActivity entry with Operation='New-InboxRule', OfficeWorkload='Exchange', UserId matching the test mailbox, and Parameters JSON containing MoveToFolder targeting 'Deleted Items' plus the SubjectOrBodyContainsWords condition list.
- Test 2Simulate Fraudulent Payment-Redirect Email to Test AP Alias
Expected signal: EmailEvents entry with SenderFromAddress matching the test mailbox, RecipientEmailAddress matching the test AP alias, and Subject/body containing payment-instruction and banking-detail keywords.
- Test 3Simulate Full Chained Sequence Within Correlation Window
Expected signal: An OfficeActivity New-InboxRule entry immediately followed by an EmailEvents entry from the same mailbox to the test AP alias, both within seconds to minutes of each other.
References (6)
- https://attack.mitre.org/techniques/T1657/
- https://attack.mitre.org/tactics/TA0040/
- https://www.ic3.gov/Media/Y2023/PSA230609
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack
- https://learn.microsoft.com/en-us/defender-office-365/advanced-hunting-emailevents-table
- https://learn.microsoft.com/en-us/powershell/module/exchange/new-inboxrule
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-BEC-InvoiceRedirectWireFraud — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month