Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-BEC-InvoiceRedirectWireFraud.
Upgrade to ProDetect BEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable in Splunk
Business Email Compromise crews executing invoice-redirect wire fraud follow a consistent two-step pattern once they have obtained credentials or an active session for a vendor-facing or internal finance mailbox (typically via phishing, MFA fatigue, or token theft — see THREAT-BEC-OAuthDeviceCode for the initial-access variant). First, the attacker creates or modifies an Exchange inbox rule that silently moves or deletes incoming messages containing invoice/payment-related keywords into Deleted Items, RSS Feeds/Subscriptions, or an obscure archive folder, so the legitimate mailbox owner never sees replies, confirmation calls, or the real vendor's follow-up correspondence about the transaction in flight. Second, from that same compromised mailbox (or a lookalike domain impersonating it), the attacker sends or replies to an active invoice/payment thread with 'updated' banking details — a new account number, routing number, or IBAN/SWIFT code — asking accounts payable or a customer to redirect an upcoming wire transfer. Individually, a new inbox rule or a payment-detail-change email can look mundane; the correlation of a hiding-behavior rule (move-to-folder or delete, scoped to invoice/payment terms) created on a mailbox, followed within a short window by an outbound email from that same mailbox to an accounts-payable/finance alias referencing altered banking instructions, is a high-fidelity indicator of active invoice-redirect fraud rather than routine mailbox housekeeping. Detection correlates Exchange admin audit events (New-InboxRule/Set-InboxRule in OfficeActivity) with Microsoft Defender for Office 365 mail flow telemetry (EmailEvents) for the same sending identity.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=o365 sourcetype="o365:management:activity" Workload=Exchange (Operation="New-InboxRule" OR Operation="Set-InboxRule")
| eval ParamText=Parameters
| where match(ParamText, "(?i)(MoveToFolder|DeleteMessage|Delete)") AND match(ParamText, "(?i)(invoice|remittance|wire transfer|bank details|account number|routing number|payment instructions|iban|swift|ach|updated banking|new bank)")
| eval MailboxOwner=lower(UserId)
| eval RuleTime=_time
| table RuleTime MailboxOwner ParamText ClientIP
| join type=inner MailboxOwner
[ search index=o365 sourcetype="o365:office365:email" (Subject="*invoice*" OR Subject="*remittance*" OR Subject="*wire transfer*" OR Subject="*bank details*" OR Subject="*payment instructions*" OR Subject="*routing number*")
(RecipientEmailAddress="ap@*" OR RecipientEmailAddress="accountspayable@*" OR RecipientEmailAddress="finance@*" OR RecipientEmailAddress="payments@*" OR RecipientEmailAddress="treasury@*")
| eval MailboxOwner=lower(SenderFromAddress)
| table _time MailboxOwner SenderFromAddress RecipientEmailAddress Subject ]
| where (_time - RuleTime) >= 0 AND (_time - RuleTime) <= 172800
| sort - _timeSPL detection over the Office 365 Management Activity API feed (Splunk Add-on for Microsoft Office 365, sourcetype o365:management:activity for admin audit events and o365:office365:email for mail flow). Correlates a hiding-behavior inbox rule scoped to payment/invoice keywords with an outbound message from the same mailbox to an accounts-payable/finance recipient within 48 hours, referencing invoice or banking-detail language. If a different Office 365 TA/sourcetype is in use, remap the Operation/Parameters/RecipientEmailAddress field names before deploying.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate finance/vendor-management inbox rules routing invoice emails into a dedicated processing folder rather than Deleted Items or Archive
- Authorized vendor banking-detail refresh verified out-of-band, coincidentally overlapping in time with an unrelated mailbox rule change
- Shared support/ticketing mailbox rules triaging messages containing payment-related keywords, paired with an unrelated automated billing notification
- Bulk IT-driven mailbox migration or retention-policy rule creation referencing generic keyword sets across many mailboxes at once
Other platforms for THREAT-BEC-InvoiceRedirectWireFraud
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Hiding Inbox Rule Scoped to Payment Keywords
Expected signal: OfficeActivity entry with Operation='New-InboxRule', OfficeWorkload='Exchange', UserId matching the test mailbox, and Parameters JSON containing MoveToFolder targeting 'Deleted Items' plus the SubjectOrBodyContainsWords condition list.
- Test 2Simulate Fraudulent Payment-Redirect Email to Test AP Alias
Expected signal: EmailEvents entry with SenderFromAddress matching the test mailbox, RecipientEmailAddress matching the test AP alias, and Subject/body containing payment-instruction and banking-detail keywords.
- Test 3Simulate Full Chained Sequence Within Correlation Window
Expected signal: An OfficeActivity New-InboxRule entry immediately followed by an EmailEvents entry from the same mailbox to the test AP alias, both within seconds to minutes of each other.
References (6)
- https://attack.mitre.org/techniques/T1657/
- https://attack.mitre.org/tactics/TA0040/
- https://www.ic3.gov/Media/Y2023/PSA230609
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack
- https://learn.microsoft.com/en-us/defender-office-365/advanced-hunting-emailevents-table
- https://learn.microsoft.com/en-us/powershell/module/exchange/new-inboxrule
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-BEC-InvoiceRedirectWireFraud — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month