Skip to content

Business Email Compromise๐Ÿ”—

The Business Email Compromise (BEC) detector identifies techniques threat actors use to persist in, collect from, and hide activity in Microsoft 365 mailboxes after gaining access to an account. It monitors cloud audit data for suspicious Exchange activity, such as inbox rules that hide, delete, or forward mail; mailbox permission changes; and outbound mail abuse.

Detections focus on what an action does to the mailbox, such as moving all incoming mail to a rarely used folder, or forwarding mail outside the organization. They do not depend on attacker-chosen details such as the name of an inbox rule. Related detections also correlate this activity with earlier suspicious sign-in behavior, so you can see the full attack chain in one place.

Business Email Compromise Detector

Requirements๐Ÿ”—

This detector requires the following data sources, integrations, or schemas:

Source Sensor Type
Streaming Azure cloud audit data MICROSOFT_OFFICE_MANAGEMENT

For correlated detections, the following is also required:

Inputs๐Ÿ”—

Detections are from the following normalized sources:

  • CloudAudit

Correlated detections also use Observation data.

Outputs๐Ÿ”—

Detections are pushed to the XDR Detection Database and Detection Triage Dashboard.

The following mailbox activity triggers detections:

  • Hiding and deleting mail:

    • Inbox rules that archive all incoming email
    • Inbox rules that move all incoming email to the Conversation History folder
    • Email forwarding to the RSS Subscriptions folder
    • Deletion of all incoming emails
    • Deletion of emails containing security-related terms (for example, "hacked" or "phished")
    • Inbox rule changes made through Outlook on the web

  • Forwarding:

    • External forwarding of emails containing BEC keywords
    • Mass forwarding to external email accounts
    • Inbox rules that forward mail to a domain different from the mailbox owner's
    • Inbox rules that forward mail to a different domain and delete or hide the local copy

  • Mailbox access and persistence:

    • Mailbox permission delegation, including Full Access grants
    • Changes to mailbox folder permissions that grant another user access
    • Mailbox audit logging bypass

  • Outbound mail abuse:

    • Multiple outbound emails blocked or quarantined by Microsoft Defender for Office 365 within a short period
    • Mass deletion of items from the Sent Items folder
Correlated detections๐Ÿ”—

When suspicious sign-in activity is followed by BEC activity for the same user, XDR creates a multi-stage detection:

  • Multi-Stage Threat Detected: AiTM Phishing Leading to BEC
  • Multi-Stage Threat Detected: Stolen Credentials Leading to BEC
  • Multi-Stage Threat Detected: Risky Authentication Leading to BE

Configuration Options๐Ÿ”—

This detector is enabled by default when the required data sources or integrations are available in the tenant.

Many organizations legitimately forward mail to partner or vendor domains and use inbox rules to organize mail. Review forwarding and inbox-rule detections together with sign-in activity and any rule-hiding behavior before taking action.

Data Limitations๐Ÿ”—

Exchange audit logs show mailbox changes reliably. They do not consistently include sender, recipient, attachment, subject, or body details, so detections cannot describe message content.

MITRE ATT&CK Category๐Ÿ”—

Detector Testing๐Ÿ”—

This detector doesn't have a supported testing method, though an Advanced Search will verify if detections originated with this detector.

Note

If no supported testing method is available, an Advanced Search will show you if any detections came from this detector if a qualifying event was observed. A search with no results doesn't indicate the detector isn't working. A lack of search results for the detector may only indicate that the specific attack has not been observed in the tenant. However, it could indicate the underlying data isn't available. Ensure the required schemas are provided in Data Sources along with the supported device type(s) for that schema.

FROM detection WHERE attack_technique_ids in ('T1114.003','T1114.002','T1564.008','T1098.002') OR metadata.creator.detector.detector_id='app:event-filter:bec'

No results doesn't mean the detector is malfunctioning. The attack pattern may not have occurred in your environment, or the underlying data may not be available.

References๐Ÿ”—