<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-business-email-compromise-patterns
description: >-
  Identify and analyze BEC attack patterns including CEO fraud, vendor impersonation, account takeover, and invoice manipulation.
domain: cybersecurity
subdomain: email-security
tags:
  - bec
  - email-fraud
  - ceo-fraud
  - account-takeover
  - social-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001", "T1534"]
---

# Detecting Business Email Compromise Patterns

## Overview

Business Email Compromise (BEC) is the highest-loss cybercrime category per
FBI IC3 reporting. Attackers impersonate executives, vendors, or partners to
redirect financial transactions. Detection relies on behavioral analysis,
communication pattern anomalies, and policy enforcement.

## Prerequisites

| Requirement | Install |
|---|---|
| Email gateway logs | Access to mail flow and authentication logs |
| SIEM platform | Splunk, Sentinel, or equivalent |
| Python 3.10+ | For agent tooling |
| Financial process docs | Wire transfer and invoice approval workflows |

## Key Concepts

### BEC Attack Types

- **CEO Fraud** — Impersonating executive to authorize urgent wire transfer
- **Vendor Impersonation** — Spoofing supplier to redirect invoice payments
- **Account Takeover** — Compromised mailbox used to send internal requests
- **Attorney Impersonation** — Posing as legal counsel for confidential transfers
- **Data Theft** — Requesting W-2/PII from HR under executive guise

### Behavioral Indicators

- Display name spoofing with lookalike domains
- Urgency language patterns
- Reply-to mismatch between display name and actual address
- First-time sender to finance team with payment request
- Mailbox rules auto-forwarding to external addresses

### Detection Approaches

- **Header analysis** — SPF/DKIM/DMARC alignment failures
- **NLP classification** — Urgency and financial keyword scoring
- **Graph analysis** — Communication pattern deviation from baseline
- **Impossible travel** — Login from anomalous geolocations before BEC send

## Workflow

1. **Baseline communication patterns** — map normal sender/recipient relationships
2. **Configure header analysis rules** — detect SPF/DKIM failures on impersonated domains
3. **Deploy display name spoofing detection** — flag external senders using internal names
4. **Implement reply-to mismatch alerts** — detect divergent reply-to addresses
5. **Build NLP urgency classifier** — score messages for BEC language patterns
6. **Monitor mailbox rule creation** — alert on auto-forward to external addresses
7. **Establish verification workflow** — out-of-band confirmation for financial requests

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Detection

```yaml
title: Business Email Compromise Patterns Detection
id: cd3b40b7-afe4-4aff-b9c5-ef4a5d2fcb33
status: experimental
description: Detects suspicious activity related to detecting business email compromise patterns techniques in email security context
logsource:
  category: email
  service: exchange
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: medium
tags:
  - attack.t1566.001
  - attack.t1534
  - attack.initial_access
falsepositives:
  - Bulk email migration by authorized IT administration tools
```

## Verification

| Check | Method |
|---|---|
| Spoofing detected | Display name impersonation flagged within 30 seconds |
| Header analysis | SPF/DKIM failures on lookalike domains generate alerts |
| Reply-to mismatch | Divergent reply-to addresses flagged for review |
| Rule monitoring | New mailbox forwarding rules trigger SOC alert |
| Pattern baseline | Communication graph updated within 24 hours |

## References

- [FBI IC3 — BEC Statistics](https://www.ic3.gov/)
- [MITRE ATT&CK — T1534](https://attack.mitre.org/techniques/T1534/)
- [Microsoft — Anti-phishing](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [CISA — BEC Guidance](https://www.cisa.gov/news-events/cybersecurity-advisories)
