Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer.
Unlock with Pro - from £29/user/moDetect BEC Financial Theft — Fraudulent Wire/ACH Transfer Initiation via Mailbox Tampering and Invoice Fraud in Sumo Logic CSE
This detection covers the final, financially damaging stage of a Business Email Compromise (BEC) intrusion: fraudulent wire or ACH transfer initiation (T1657 — Financial Theft) that follows mailbox rule tampering and invoice/payment-detail modification. Having already gained access to a mailbox (via phishing, OAuth token theft, or credential stuffing), the attacker creates hidden inbox rules that forward, redirect, or delete messages matching finance-related keywords so the victim never sees replies from the real vendor or their own finance team. The attacker then sends or intercepts an invoice, purchase order, or payroll email and modifies the banking details — swapping the legitimate account/routing number or IBAN for an attacker-controlled mule account — while adding urgency language ("process today", "do not call, I am in a meeting") to pressure the victim into skipping out-of-band verification. Groups such as Cosmic Lynx (Russian-speaking, CEO-fraud wire transfers averaging $1.27M) and SilverTerrier (West African vendor-invoice-swap BEC) follow this exact three-stage pattern: mailbox tampering, payment-detail modification, then transfer initiation. Because banking-portal telemetry is rarely centralized in a SIEM, this detection correlates the two upstream stages that ARE consistently observable in mail and identity telemetry — malicious inbox rule creation and financial-fraud-pattern email content — as the highest-fidelity proxy for an active wire fraud attempt, with escalation criteria pointing responders at the actual funds-transfer confirmation step.
MITRE ATT&CK
- Tactic
- Impact
Sumo Detection Query
_sourceCategory="o365"
| json field=_raw "Operation", "UserId", "ClientIP", "Parameters", "Subject", "SenderFromAddress", "RecipientEmailAddress" nodrop
| eval mailbox_tamper = if(
Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "UpdateInboxRules") AND
matches(Parameters, "(?i)(ForwardTo|RedirectTo|ForwardAsAttachmentTo|DeleteMessage|MoveToFolder|StopProcessingRules)") AND
!matches(Parameters, "(?i)Junk Email"),
"true", "false"
)
| eval finance_fraud_email = if(
matches(Subject, "(?i)(wire transfer|ach transfer|routing number|account number|swift code|iban|beneficiary|new bank details|updated payment details|remittance|invoice attached|change of bank account|payment instructions|vendor payment)") AND
matches(Subject, "(?i)(urgent|immediately|asap|time sensitive|confidential|do not call|cannot talk|process today|before end of day)"),
"true", "false"
)
| where mailbox_tamper = "true" OR finance_fraud_email = "true"
| timeslice 72h
| stats
count as Events,
values(Operation) as Operations,
values(Parameters) as RuleParams,
values(Subject) as Subjects,
values(ClientIP) as IPs
by UserId, _timeslice
| where Events > 1
| eval ThreatType = "BEC_WireFraud_MailboxTamper_Correlation"
| fields UserId, _timeslice, Events, Operations, RuleParams, Subjects, IPs
| sort by Events descDetects the combined BEC wire-fraud pattern in Microsoft 365 audit and email telemetry ingested to Sumo Logic — mailbox rule tampering co-occurring with finance-fraud-pattern, urgency-laden email subjects within a 72-hour window per user.
Data Sources
Required Tables
False Positives & Tuning
- Finance department staff creating filing rules for paid invoices during routine urgent payment cycles
- Payroll automation mailboxes generating high volumes of time-sensitive payment email
- Org-wide IT mail-flow rule deployments that incidentally touch finance mailboxes
Other platforms for THREAT-Impact-BECFinancialTheftWireTransfer
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create BEC-Style Mailbox Forwarding Rule Targeting Finance Keywords
Expected signal: OfficeActivity records a New-InboxRule operation with Parameters containing ForwardTo, DeleteMessage, and the finance-related SubjectContainsWords condition.
- Test 2Send Simulated Vendor Invoice Email with Bank-Detail-Change and Urgency Language
Expected signal: EmailEvents records the inbound message with Subject matching finance/urgency keyword patterns; message trace shows sender domain external-test.com.
- Test 3End-to-End BEC Wire Fraud Simulation (Rule Tampering + Fraud Email in Sequence)
Expected signal: OfficeActivity and EmailEvents both record events for the same UserId within the 72-hour correlation window.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-BECFinancialTheftWireTransfer — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.