<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-business-email-compromise
description: >-
  Detect, investigate, and respond to BEC attacks targeting financial transactions and executive communications.
domain: cybersecurity
subdomain: social-engineering
tags:
  - bec
  - email-security
  - fraud
  - social-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1534"]
---

# Analyzing Business Email Compromise

## Overview

Detect, investigate, and respond to BEC attacks targeting financial transactions and executive communications.

## Prerequisites

| Requirement | Install |
|---|---|
| Email gateway | Mail flow logs |
| SIEM | Alert correlation |
| Python 3.10+ | For agent tooling |

## Key Concepts

BEC attacks impersonate executives or vendors to redirect payments.
Analysis covers email header forensics, domain spoofing detection,
payment flow anomalies, and account takeover indicators.

## Quick Reference

```bash
node agent.js analyze --email suspected-bec.eml
node agent.js domain-check --domain supplier-co.com
node agent.js trace-payment --invoice INV-2026-4532
node agent.js report --incident BEC-2026-012
```

## Workflow

1. Receive suspected BEC alert
2. Analyze email headers
3. Check sender domain
4. Verify SPF/DKIM/DMARC
5. Trace payment requests
6. Correlate with known campaigns
7. Generate report

## Verification

- Verify header parsing
- Confirm domain check finds lookalikes
- Validate payment tracing
- Check financial exposure
- Verify rules updated

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
