Which SIEM platforms have a THREAT-Impact-BECFinancialTheftWireTransfer detection rule?

df00tech provides THREAT-Impact-BECFinancialTheftWireTransfer (BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-Impact-BECFinancialTheftWireTransfer detection?

The THREAT-Impact-BECFinancialTheftWireTransfer detection is rated critical severity with high confidence.

What are common false positives for THREAT-Impact-BECFinancialTheftWireTransfer?

Common false positives for THREAT-Impact-BECFinancialTheftWireTransfer include: Legitimate finance staff creating inbox rules to file paid invoices into an archive folder, coinciding by chance with routine vendor payment correspondence; Accounts payable teams sending genuine wire/ACH confirmation emails with urgency language during month-end close; Treasury or payroll automation mailboxes that both apply mail-flow rules and send high volume of payment-related email as part of normal operations.

Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer.

Unlock with Pro - from £29/user/mo

THREAT-Impact-BECFinancialTheftWireTransfer

Financial Theft — BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud

Q: What data sources are required to detect BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud (THREAT-Impact-BECFinancialTheftWireTransfer)?

Detecting BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud requires the following data sources: Office 365 Unified Audit Log (OfficeActivity), Microsoft Defender for Office 365 (EmailEvents), Microsoft 365 Message Trace.

Impact Last updated: July 29, 2026

This detection covers the final, financially damaging stage of a Business Email Compromise (BEC) intrusion: fraudulent wire or ACH transfer initiation (T1657 — Financial Theft) that follows mailbox rule tampering and invoice/payment-detail modification. Having already gained access to a mailbox (via phishing, OAuth token theft, or credential stuffing), the attacker creates hidden inbox rules that forward, redirect, or delete messages matching finance-related keywords so the victim never sees replies from the real vendor or their own finance team. The attacker then sends or intercepts an invoice, purchase order, or payroll email and modifies the banking details — swapping the legitimate account/routing number or IBAN for an attacker-controlled mule account — while adding urgency language ("process today", "do not call, I am in a meeting") to pressure the victim into skipping out-of-band verification. Groups such as Cosmic Lynx (Russian-speaking, CEO-fraud wire transfers averaging $1.27M) and SilverTerrier (West African vendor-invoice-swap BEC) follow this exact three-stage pattern: mailbox tampering, payment-detail modification, then transfer initiation. Because banking-portal telemetry is rarely centralized in a SIEM, this detection correlates the two upstream stages that ARE consistently observable in mail and identity telemetry — malicious inbox rule creation and financial-fraud-pattern email content — as the highest-fidelity proxy for an active wire fraud attempt, with escalation criteria pointing responders at the actual funds-transfer confirmation step.

What is THREAT-Impact-BECFinancialTheftWireTransfer BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud?

BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud (THREAT-Impact-BECFinancialTheftWireTransfer) is a sub-technique of Financial Theft (T1657) in the MITRE ATT&CK framework. It maps to the Impact tactic — the adversary is trying to manipulate, interrupt, or destroy your systems and data.

This page provides production-ready detection logic for BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud, covering the data sources and telemetry it touches: Office 365 Unified Audit Log (OfficeActivity), Microsoft Defender for Office 365 (EmailEvents), Microsoft 365 Message Trace. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Impact

Microsoft Sentinel / Defender

kusto

// THREAT-Impact-BECFinancialTheftWireTransfer (T1657 Financial Theft)
// Correlates mailbox rule tampering with financial-fraud-pattern email content to surface active BEC wire/ACH fraud
let Lookback = 7d;
let CorrelationWindowHours = 72;
let FinanceKeywords = dynamic(["wire transfer", "wire the funds", "ach transfer", "routing number", "account number", "swift code", "iban", "beneficiary", "new bank details", "updated payment details", "remittance", "invoice attached", "change of bank account", "payment instructions", "vendor payment"]);
let UrgencyKeywords = dynamic(["urgent", "immediately", "asap", "time sensitive", "confidential", "do not call", "cannot talk", "process today", "before end of day"]);
// Stage 1: mailbox rule tampering that hides finance-thread replies from the victim
let MailboxTampering = OfficeActivity
| where TimeGenerated > ago(Lookback)
| where Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules")
| where Parameters has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo", "DeleteMessage", "MoveToFolder", "StopProcessingRules")
| where Parameters !has "Junk Email"
| project TimeGenerated, UserId, ClientIP, Operation, Parameters
| extend Stage = "MailboxTampering";
// Stage 2: inbound/outbound email matching wire-fraud content and urgency-pressure language
let FraudulentFinanceEmail = EmailEvents
| where TimeGenerated > ago(Lookback)
| where Subject has_any (FinanceKeywords)
| where Subject has_any (UrgencyKeywords) or EmailDirection == "Outbound"
| project TimeGenerated, UserId = SenderFromAddress, RecipientEmailAddress, Subject, SenderIPv4, EmailDirection
| extend Stage = "FinanceEmailContent";
// Correlate: same mailbox shows tampering followed by finance-fraud email content within the window
MailboxTampering
| join kind=inner (FraudulentFinanceEmail) on UserId
| where datetime_diff('hour', TimeGenerated1, TimeGenerated) between (0 .. CorrelationWindowHours)
| project TamperTime = TimeGenerated, EmailTime = TimeGenerated1, UserId, ClientIP, Operation, Parameters, RecipientEmailAddress, Subject, SenderIPv4, EmailDirection
| extend ThreatType = "BEC_WireFraud_MailboxTamper_Correlation"
| sort by TamperTime desc

Two-stage correlation over Office 365 audit and Defender for Office 365 mail telemetry: (1) mailbox rule creation/modification with forwarding, redirection, or deletion parameters that would hide replies from the real vendor or finance team, and (2) email content matching wire-transfer/ACH/bank-detail-change keywords combined with urgency-pressure language. The inner join surfaces mailboxes where tampering occurred within 72 hours of a finance-fraud-pattern email — the strongest observable proxy for an active BEC wire-fraud attempt short of the actual funds-transfer confirmation.

critical severity high confidence

Data Sources

Office 365 Unified Audit Log (OfficeActivity) Microsoft Defender for Office 365 (EmailEvents) Microsoft 365 Message Trace

Required Tables

OfficeActivity EmailEvents

False Positives

Legitimate finance staff creating inbox rules to file paid invoices into an archive folder, coinciding by chance with routine vendor payment correspondence
Accounts payable teams sending genuine wire/ACH confirmation emails with urgency language during month-end close
Treasury or payroll automation mailboxes that both apply mail-flow rules and send high volume of payment-related email as part of normal operations
Legal/compliance holds that create forwarding rules to an e-discovery mailbox for finance-related correspondence

Splunk

spl

index=o365 sourcetype="o365:management:activity"
(
  Operation IN ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules")
  OR sourcetype="o365:defender:email"
)
| eval mailbox_tamper=if(
    Operation IN ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules") AND
    match(Parameters, "(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder|StopProcessingRules)") AND
    NOT match(Parameters, "(?i)Junk Email"),
    "true", "false"
  )
| eval finance_fraud_email=if(
    match(Subject, "(?i)(wire transfer|ach transfer|routing number|account number|swift code|iban|beneficiary|new bank details|updated payment details|remittance|invoice attached|change of bank account|payment instructions|vendor payment)") AND
    match(Subject, "(?i)(urgent|immediately|asap|time sensitive|confidential|do not call|cannot talk|process today|before end of day)"),
    "true", "false"
  )
| where mailbox_tamper="true" OR finance_fraud_email="true"
| stats
    count AS Events,
    values(Operation) AS Operations,
    values(Parameters) AS RuleParams,
    values(Subject) AS Subjects,
    values(ClientIP) AS IPs,
    earliest(_time) AS FirstEvent,
    latest(_time) AS LastEvent
  BY UserId
| eval WindowHours=round((LastEvent-FirstEvent)/3600,1)
| where (mvfind(Operations, "InboxRule") >= 0 OR mvfind(Operations, "Mailbox") >= 0) AND WindowHours <= 72
| eval ThreatType="BEC_WireFraud_MailboxTamper_Correlation"
| sort - Events

SPL correlation over O365 management activity and Defender for Office 365 email indexes. Flags accounts where inbox-rule/mailbox tampering (forward, redirect, delete, move-to-folder) co-occurs within a 72-hour window with email subjects matching wire/ACH/bank-detail-change fraud language paired with urgency-pressure phrasing — the combined pattern used in Cosmic Lynx and SilverTerrier CEO-fraud and vendor-invoice-swap campaigns.

critical severity high confidence

Data Sources

Office 365 Management Activity API Microsoft Defender for Office 365 email telemetry via Splunk Add-on

Required Sourcetypes

o365:management:activity o365:defender:email

False Positives

AP/AR staff filing legitimate paid-invoice email into folders via inbox rules during the same window as routine vendor payment correspondence
Payroll processing mailboxes sending high volumes of urgent, time-sensitive payment confirmations at month-end or pay-cycle close
IT-managed mail-flow rules deployed org-wide that happen to touch finance mailboxes during a rollout
Legal hold / e-discovery forwarding rules applied to finance department mailboxes

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  username AS Username,
  sourceip AS SourceIP,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "Operation",
  "Parameters",
  "Subject",
  CASE
    WHEN "Operation" IN ('New-InboxRule', 'Set-InboxRule', 'Set-Mailbox', 'UpdateInboxRules')
      AND ("Parameters" ILIKE '%ForwardTo%' OR "Parameters" ILIKE '%RedirectTo%' OR "Parameters" ILIKE '%DeleteMessage%' OR "Parameters" ILIKE '%MoveToFolder%')
      THEN 'MAILBOX_TAMPERING'
    WHEN ("Subject" ILIKE '%wire transfer%' OR "Subject" ILIKE '%ACH transfer%' OR "Subject" ILIKE '%routing number%' OR "Subject" ILIKE '%bank details%' OR "Subject" ILIKE '%payment instructions%')
      AND ("Subject" ILIKE '%urgent%' OR "Subject" ILIKE '%immediately%' OR "Subject" ILIKE '%ASAP%' OR "Subject" ILIKE '%process today%')
      THEN 'FINANCE_FRAUD_EMAIL'
    ELSE 'OTHER'
  END AS DetectionType
FROM events
WHERE
  LOGSOURCETYPEID = 397
  AND starttime > NOW() - 604800000
  AND (
    ("Operation" IN ('New-InboxRule', 'Set-InboxRule', 'Set-Mailbox', 'UpdateInboxRules')
      AND ("Parameters" ILIKE '%ForwardTo%' OR "Parameters" ILIKE '%RedirectTo%' OR "Parameters" ILIKE '%DeleteMessage%' OR "Parameters" ILIKE '%MoveToFolder%')
      AND "Parameters" NOT ILIKE '%Junk Email%')
    OR (
      ("Subject" ILIKE '%wire transfer%' OR "Subject" ILIKE '%ACH transfer%' OR "Subject" ILIKE '%routing number%' OR "Subject" ILIKE '%bank details%' OR "Subject" ILIKE '%payment instructions%')
      AND ("Subject" ILIKE '%urgent%' OR "Subject" ILIKE '%immediately%' OR "Subject" ILIKE '%ASAP%' OR "Subject" ILIKE '%process today%')
    )
  )
ORDER BY starttime DESC

QRadar AQL flagging mailbox tampering (forwarding/redirect/delete inbox rules) and financial-fraud-pattern email content with urgency language from O365 audit events, for manual or rule-chained correlation within a 72-hour window per user.

critical severity high confidence

Data Sources

IBM QRadar O365 DSM Microsoft Defender for Office 365 via QRadar

Required Tables

events

False Positives

Legitimate finance/AP staff filing invoices via inbox rules while separately sending urgent payment confirmations
Payroll processing mailboxes with routine high-urgency payment email volume

Sumo Logic CSE

sql

_sourceCategory="o365"
| json field=_raw "Operation", "UserId", "ClientIP", "Parameters", "Subject", "SenderFromAddress", "RecipientEmailAddress" nodrop
| eval mailbox_tamper = if(
    Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules") AND
    matches(Parameters, "(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder|StopProcessingRules)") AND
    !matches(Parameters, "(?i)Junk Email"),
    "true", "false"
  )
| eval finance_fraud_email = if(
    matches(Subject, "(?i)(wire transfer|ach transfer|routing number|account number|swift code|iban|beneficiary|new bank details|updated payment details|remittance|invoice attached|change of bank account|payment instructions|vendor payment)") AND
    matches(Subject, "(?i)(urgent|immediately|asap|time sensitive|confidential|do not call|cannot talk|process today|before end of day)"),
    "true", "false"
  )
| where mailbox_tamper = "true" OR finance_fraud_email = "true"
| timeslice 72h
| stats
    count as Events,
    values(Operation) as Operations,
    values(Parameters) as RuleParams,
    values(Subject) as Subjects,
    values(ClientIP) as IPs
  by UserId, _timeslice
| where Events > 1
| eval ThreatType = "BEC_WireFraud_MailboxTamper_Correlation"
| fields UserId, _timeslice, Events, Operations, RuleParams, Subjects, IPs
| sort by Events desc

Detects the combined BEC wire-fraud pattern in Microsoft 365 audit and email telemetry ingested to Sumo Logic — mailbox rule tampering co-occurring with finance-fraud-pattern, urgency-laden email subjects within a 72-hour window per user.

critical severity high confidence

Data Sources

Microsoft 365 Management Activity Logs

Required Tables

o365 management activity logs ingested under _sourceCategory=o365

False Positives

Finance department staff creating filing rules for paid invoices during routine urgent payment cycles
Payroll automation mailboxes generating high volumes of time-sensitive payment email
Org-wide IT mail-flow rule deployments that incidentally touch finance mailboxes

Google Chronicle / SecOps

yaral

rule bec_financial_theft_wire_transfer {
  meta:
    author = "df00tech"
    description = "Detects BEC financial theft: mailbox rule tampering correlated with wire/ACH/bank-detail-change email content carrying urgency language, indicating an active fraudulent wire transfer setup. Threat actors: Cosmic Lynx, SilverTerrier, TA4557."
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1657/"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1657"

  events:
    // Event 1: mailbox rule tampering (forward/redirect/delete) hiding finance-thread replies
    (
      $e1.metadata.event_type = "EMAIL_TRANSACTION"
      AND re.regex($e1.metadata.description, `(?i)(New-InboxRule|Set-InboxRule|Set-Mailbox|UpdateInboxRules)`)
      AND re.regex($e1.about.labels["Parameters"], `(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder)`)
      AND NOT re.regex($e1.about.labels["Parameters"], `(?i)Junk Email`)
      AND $user = $e1.principal.user.userid
    )
    OR
    // Event 2: financial-fraud-pattern email with urgency-pressure language
    (
      $e2.metadata.event_type = "EMAIL_TRANSACTION"
      AND re.regex($e2.network.email.subject, `(?i)(wire transfer|ACH transfer|routing number|account number|swift code|IBAN|beneficiary|new bank details|change of bank account|payment instructions|vendor payment)`)
      AND re.regex($e2.network.email.subject, `(?i)(urgent|immediately|ASAP|time sensitive|confidential|do not call|process today)`)
      AND $user = $e2.principal.user.userid
    )

  match:
    $user over 72h

  condition:
    $e1 and $e2
}

YARA-L 2.0 rule for Google Chronicle correlating mailbox rule tampering with financial-fraud-pattern email content carrying urgency language for the same user within a 72-hour window — the observable signature of an in-progress BEC wire/ACH transfer fraud.

critical severity high confidence

Data Sources

Microsoft 365 Management Activity Logs via Chronicle ingestion Microsoft Defender for Office 365 email UDM events

Required Tables

UDM events with metadata.event_type EMAIL_TRANSACTION from M365/O365 log sources

False Positives

Finance department staff filing paid invoices via inbox rules while sending genuine urgent payment confirmations in the same window
Payroll or AP automation mailboxes with routine rule-based filing and high-urgency payment email volume

CrowdStrike LogScale (CQL)

cql

// BEC Financial Theft: Mailbox Tampering Correlated with Wire/ACH Fraud Email Content
#repo=base_activity
(
  // Branch 1: mailbox rule tampering
  Operation IN ["New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules"]
  AND Parameters = /(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder)/
  AND Parameters != /(?i)Junk Email/
  AND EventSource = "O365"
| groupBy(
    [UserId, ClientIP, Operation],
    function=[
      count(aid, as=RuleEvents),
      min(timestamp, as=FirstSeen),
      max(timestamp, as=LastSeen),
      collect(Parameters, as=RuleParams)
    ]
  )
| eval Stage = "MailboxTampering"
| sort(RuleEvents, order=desc)
)

UNION

(
  // Branch 2: wire/ACH/bank-detail-change email with urgency language
  EventSource = "O365"
  AND Subject = /(?i)(wire transfer|ACH transfer|routing number|account number|swift code|IBAN|beneficiary|new bank details|change of bank account|payment instructions|vendor payment)/
  AND Subject = /(?i)(urgent|immediately|ASAP|time sensitive|confidential|do not call|process today)/
| groupBy(
    [UserId, SenderFromAddress, RecipientEmailAddress],
    function=[
      count(aid, as=EmailEvents),
      min(timestamp, as=FirstSeen),
      max(timestamp, as=LastSeen),
      collect(Subject, as=Subjects)
    ]
  )
| eval Stage = "FinanceFraudEmail"
| sort(EmailEvents, order=desc)
)

CrowdStrike LogScale CQL detection split into two correlated branches for BEC wire/ACH financial theft: (1) mailbox rule tampering with forward/redirect/delete/move parameters, and (2) email content matching wire-transfer/bank-detail-change language paired with urgency-pressure phrasing. Results grouped by user for downstream correlation of both stages within a 72-hour window.

critical severity high confidence

Data Sources

Microsoft 365 Management Activity Logs via CrowdStrike Falcon LogScale

Required Tables

base_activity repository with O365 event sources ingested into Falcon LogScale

False Positives

AP/finance staff filing paid invoices via inbox rules coinciding with routine urgent payment confirmations
Payroll automation mailboxes generating high-urgency payment email at pay-cycle close

Sigma rule & cross-platform mapping

The detection logic for BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud (THREAT-Impact-BECFinancialTheftWireTransfer) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  product: azure

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for THREAT-Impact-BECFinancialTheftWireTransfer Sigma rules on detection.fyi

Platform-specific guides for THREAT-Impact-BECFinancialTheftWireTransfer

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-07-29 Research depth: deep

References (4)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Create BEC-Style Mailbox Forwarding Rule Targeting Finance Keywords
Expected signal: OfficeActivity records a New-InboxRule operation with Parameters containing ForwardTo, DeleteMessage, and the finance-related SubjectContainsWords condition.
Test 2Send Simulated Vendor Invoice Email with Bank-Detail-Change and Urgency Language
Expected signal: EmailEvents records the inbound message with Subject matching finance/urgency keyword patterns; message trace shows sender domain external-test.com.
Test 3End-to-End BEC Wire Fraud Simulation (Rule Tampering + Fraud Email in Sequence)
Expected signal: OfficeActivity and EmailEvents both record events for the same UserId within the 72-hour correlation window.

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock playbooks & atomic tests with Pro

Get the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Tactic Hub

TA0040Impact

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

THREAT-BEC-InvoiceRedirectWireFraudBEC Invoice Redirect - Hidden Inbox Rule Paired With Fraudulent Wire Transfer Instructions to Accounts Payable

Parent Technique

T1657Financial Theft

Related Techniques

T1114.003Email Forwarding Rule T1137.005Outlook Rules T1656Impersonation T1598.003Spearphishing Link T1078.004Cloud Accounts T1583.001Domains

Financial Theft — BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud

What is THREAT-Impact-BECFinancialTheftWireTransfer BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Impact-BECFinancialTheftWireTransfer

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (1)

Parent Technique

Related Techniques

Same Tactic: Impact

Popular Detections

What is THREAT-Impact-BECFinancialTheftWireTransfer BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Impact-BECFinancialTheftWireTransfer

Testing Methodology

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (1)

Parent Technique

Related Techniques

Same Tactic: Impact

Popular Detections

Get new detections in your inbox