Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer.
Unlock with Pro - from £29/user/moDetect BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud in CrowdStrike LogScale
This detection covers the final, financially damaging stage of a Business Email Compromise (BEC) intrusion: fraudulent wire or ACH transfer initiation (T1657 — Financial Theft) that follows mailbox rule tampering and invoice/payment-detail modification. Having already gained access to a mailbox (via phishing, OAuth token theft, or credential stuffing), the attacker creates hidden inbox rules that forward, redirect, or delete messages matching finance-related keywords so the victim never sees replies from the real vendor or their own finance team. The attacker then sends or intercepts an invoice, purchase order, or payroll email and modifies the banking details — swapping the legitimate account/routing number or IBAN for an attacker-controlled mule account — while adding urgency language ("process today", "do not call, I am in a meeting") to pressure the victim into skipping out-of-band verification. Groups such as Cosmic Lynx (Russian-speaking, CEO-fraud wire transfers averaging $1.27M) and SilverTerrier (West African vendor-invoice-swap BEC) follow this exact three-stage pattern: mailbox tampering, payment-detail modification, then transfer initiation. Because banking-portal telemetry is rarely centralized in a SIEM, this detection correlates the two upstream stages that ARE consistently observable in mail and identity telemetry — malicious inbox rule creation and financial-fraud-pattern email content — as the highest-fidelity proxy for an active wire fraud attempt, with escalation criteria pointing responders at the actual funds-transfer confirmation step.
MITRE ATT&CK
- Tactic
- Impact
LogScale Detection Query
// BEC Financial Theft: Mailbox Tampering Correlated with Wire/ACH Fraud Email Content
#repo=base_activity
(
// Branch 1: mailbox rule tampering
Operation IN ["New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules"]
AND Parameters = /(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder)/
AND Parameters != /(?i)Junk Email/
AND EventSource = "O365"
| groupBy(
[UserId, ClientIP, Operation],
function=[
count(aid, as=RuleEvents),
min(timestamp, as=FirstSeen),
max(timestamp, as=LastSeen),
collect(Parameters, as=RuleParams)
]
)
| eval Stage = "MailboxTampering"
| sort(RuleEvents, order=desc)
)
UNION
(
// Branch 2: wire/ACH/bank-detail-change email with urgency language
EventSource = "O365"
AND Subject = /(?i)(wire transfer|ACH transfer|routing number|account number|swift code|IBAN|beneficiary|new bank details|change of bank account|payment instructions|vendor payment)/
AND Subject = /(?i)(urgent|immediately|ASAP|time sensitive|confidential|do not call|process today)/
| groupBy(
[UserId, SenderFromAddress, RecipientEmailAddress],
function=[
count(aid, as=EmailEvents),
min(timestamp, as=FirstSeen),
max(timestamp, as=LastSeen),
collect(Subject, as=Subjects)
]
)
| eval Stage = "FinanceFraudEmail"
| sort(EmailEvents, order=desc)
)CrowdStrike LogScale CQL detection split into two correlated branches for BEC wire/ACH financial theft: (1) mailbox rule tampering with forward/redirect/delete/move parameters, and (2) email content matching wire-transfer/bank-detail-change language paired with urgency-pressure phrasing. Results grouped by user for downstream correlation of both stages within a 72-hour window.
Data Sources
Required Tables
False Positives & Tuning
- AP/finance staff filing paid invoices via inbox rules coinciding with routine urgent payment confirmations
- Payroll automation mailboxes generating high-urgency payment email at pay-cycle close
Other platforms for THREAT-Impact-BECFinancialTheftWireTransfer
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create BEC-Style Mailbox Forwarding Rule Targeting Finance Keywords
Expected signal: OfficeActivity records a New-InboxRule operation with Parameters containing ForwardTo, DeleteMessage, and the finance-related SubjectContainsWords condition.
- Test 2Send Simulated Vendor Invoice Email with Bank-Detail-Change and Urgency Language
Expected signal: EmailEvents records the inbound message with Subject matching finance/urgency keyword patterns; message trace shows sender domain external-test.com.
- Test 3End-to-End BEC Wire Fraud Simulation (Rule Tampering + Fraud Email in Sequence)
Expected signal: OfficeActivity and EmailEvents both record events for the same UserId within the 72-hour correlation window.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.