Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer.
Unlock with Pro - from £29/user/moDetect BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud in Google Chronicle
This detection covers the final, financially damaging stage of a Business Email Compromise (BEC) intrusion: fraudulent wire or ACH transfer initiation (T1657 — Financial Theft) that follows mailbox rule tampering and invoice/payment-detail modification. Having already gained access to a mailbox (via phishing, OAuth token theft, or credential stuffing), the attacker creates hidden inbox rules that forward, redirect, or delete messages matching finance-related keywords so the victim never sees replies from the real vendor or their own finance team. The attacker then sends or intercepts an invoice, purchase order, or payroll email and modifies the banking details — swapping the legitimate account/routing number or IBAN for an attacker-controlled mule account — while adding urgency language ("process today", "do not call, I am in a meeting") to pressure the victim into skipping out-of-band verification. Groups such as Cosmic Lynx (Russian-speaking, CEO-fraud wire transfers averaging $1.27M) and SilverTerrier (West African vendor-invoice-swap BEC) follow this exact three-stage pattern: mailbox tampering, payment-detail modification, then transfer initiation. Because banking-portal telemetry is rarely centralized in a SIEM, this detection correlates the two upstream stages that ARE consistently observable in mail and identity telemetry — malicious inbox rule creation and financial-fraud-pattern email content — as the highest-fidelity proxy for an active wire fraud attempt, with escalation criteria pointing responders at the actual funds-transfer confirmation step.
MITRE ATT&CK
- Tactic
- Impact
YARA-L Detection Query
rule bec_financial_theft_wire_transfer {
meta:
author = "df00tech"
description = "Detects BEC financial theft: mailbox rule tampering correlated with wire/ACH/bank-detail-change email content carrying urgency language, indicating an active fraudulent wire transfer setup. Threat actors: Cosmic Lynx, SilverTerrier, TA4557."
severity = "CRITICAL"
priority = "HIGH"
reference = "https://attack.mitre.org/techniques/T1657/"
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1657"
events:
// Event 1: mailbox rule tampering (forward/redirect/delete) hiding finance-thread replies
(
$e1.metadata.event_type = "EMAIL_TRANSACTION"
AND re.regex($e1.metadata.description, `(?i)(New-InboxRule|Set-InboxRule|Set-Mailbox|UpdateInboxRules)`)
AND re.regex($e1.about.labels["Parameters"], `(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder)`)
AND NOT re.regex($e1.about.labels["Parameters"], `(?i)Junk Email`)
AND $user = $e1.principal.user.userid
)
OR
// Event 2: financial-fraud-pattern email with urgency-pressure language
(
$e2.metadata.event_type = "EMAIL_TRANSACTION"
AND re.regex($e2.network.email.subject, `(?i)(wire transfer|ACH transfer|routing number|account number|swift code|IBAN|beneficiary|new bank details|change of bank account|payment instructions|vendor payment)`)
AND re.regex($e2.network.email.subject, `(?i)(urgent|immediately|ASAP|time sensitive|confidential|do not call|process today)`)
AND $user = $e2.principal.user.userid
)
match:
$user over 72h
condition:
$e1 and $e2
}YARA-L 2.0 rule for Google Chronicle correlating mailbox rule tampering with financial-fraud-pattern email content carrying urgency language for the same user within a 72-hour window — the observable signature of an in-progress BEC wire/ACH transfer fraud.
Data Sources
Required Tables
False Positives & Tuning
- Finance department staff filing paid invoices via inbox rules while sending genuine urgent payment confirmations in the same window
- Payroll or AP automation mailboxes with routine rule-based filing and high-urgency payment email volume
Other platforms for THREAT-Impact-BECFinancialTheftWireTransfer
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create BEC-Style Mailbox Forwarding Rule Targeting Finance Keywords
Expected signal: OfficeActivity records a New-InboxRule operation with Parameters containing ForwardTo, DeleteMessage, and the finance-related SubjectContainsWords condition.
- Test 2Send Simulated Vendor Invoice Email with Bank-Detail-Change and Urgency Language
Expected signal: EmailEvents records the inbound message with Subject matching finance/urgency keyword patterns; message trace shows sender domain external-test.com.
- Test 3End-to-End BEC Wire Fraud Simulation (Rule Tampering + Fraud Email in Sequence)
Expected signal: OfficeActivity and EmailEvents both record events for the same UserId within the 72-hour correlation window.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.