Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer.
Unlock with Pro - from £29/user/moDetect BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud in Splunk
This detection covers the final, financially damaging stage of a Business Email Compromise (BEC) intrusion: fraudulent wire or ACH transfer initiation (T1657 — Financial Theft) that follows mailbox rule tampering and invoice/payment-detail modification. Having already gained access to a mailbox (via phishing, OAuth token theft, or credential stuffing), the attacker creates hidden inbox rules that forward, redirect, or delete messages matching finance-related keywords so the victim never sees replies from the real vendor or their own finance team. The attacker then sends or intercepts an invoice, purchase order, or payroll email and modifies the banking details — swapping the legitimate account/routing number or IBAN for an attacker-controlled mule account — while adding urgency language ("process today", "do not call, I am in a meeting") to pressure the victim into skipping out-of-band verification. Groups such as Cosmic Lynx (Russian-speaking, CEO-fraud wire transfers averaging $1.27M) and SilverTerrier (West African vendor-invoice-swap BEC) follow this exact three-stage pattern: mailbox tampering, payment-detail modification, then transfer initiation. Because banking-portal telemetry is rarely centralized in a SIEM, this detection correlates the two upstream stages that ARE consistently observable in mail and identity telemetry — malicious inbox rule creation and financial-fraud-pattern email content — as the highest-fidelity proxy for an active wire fraud attempt, with escalation criteria pointing responders at the actual funds-transfer confirmation step.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=o365 sourcetype="o365:management:activity"
(
Operation IN ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules")
OR sourcetype="o365:defender:email"
)
| eval mailbox_tamper=if(
Operation IN ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules") AND
match(Parameters, "(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder|StopProcessingRules)") AND
NOT match(Parameters, "(?i)Junk Email"),
"true", "false"
)
| eval finance_fraud_email=if(
match(Subject, "(?i)(wire transfer|ach transfer|routing number|account number|swift code|iban|beneficiary|new bank details|updated payment details|remittance|invoice attached|change of bank account|payment instructions|vendor payment)") AND
match(Subject, "(?i)(urgent|immediately|asap|time sensitive|confidential|do not call|cannot talk|process today|before end of day)"),
"true", "false"
)
| where mailbox_tamper="true" OR finance_fraud_email="true"
| stats
count AS Events,
values(Operation) AS Operations,
values(Parameters) AS RuleParams,
values(Subject) AS Subjects,
values(ClientIP) AS IPs,
earliest(_time) AS FirstEvent,
latest(_time) AS LastEvent
BY UserId
| eval WindowHours=round((LastEvent-FirstEvent)/3600,1)
| where (mvfind(Operations, "InboxRule") >= 0 OR mvfind(Operations, "Mailbox") >= 0) AND WindowHours <= 72
| eval ThreatType="BEC_WireFraud_MailboxTamper_Correlation"
| sort - EventsSPL correlation over O365 management activity and Defender for Office 365 email indexes. Flags accounts where inbox-rule/mailbox tampering (forward, redirect, delete, move-to-folder) co-occurs within a 72-hour window with email subjects matching wire/ACH/bank-detail-change fraud language paired with urgency-pressure phrasing — the combined pattern used in Cosmic Lynx and SilverTerrier CEO-fraud and vendor-invoice-swap campaigns.
Data Sources
Required Sourcetypes
False Positives & Tuning
- AP/AR staff filing legitimate paid-invoice email into folders via inbox rules during the same window as routine vendor payment correspondence
- Payroll processing mailboxes sending high volumes of urgent, time-sensitive payment confirmations at month-end or pay-cycle close
- IT-managed mail-flow rules deployed org-wide that happen to touch finance mailboxes during a rollout
- Legal hold / e-discovery forwarding rules applied to finance department mailboxes
Other platforms for THREAT-Impact-BECFinancialTheftWireTransfer
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create BEC-Style Mailbox Forwarding Rule Targeting Finance Keywords
Expected signal: OfficeActivity records a New-InboxRule operation with Parameters containing ForwardTo, DeleteMessage, and the finance-related SubjectContainsWords condition.
- Test 2Send Simulated Vendor Invoice Email with Bank-Detail-Change and Urgency Language
Expected signal: EmailEvents records the inbound message with Subject matching finance/urgency keyword patterns; message trace shows sender domain external-test.com.
- Test 3End-to-End BEC Wire Fraud Simulation (Rule Tampering + Fraud Email in Sequence)
Expected signal: OfficeActivity and EmailEvents both record events for the same UserId within the 72-hour correlation window.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.