<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Business Email Compromise

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js scan-lookalikes <domain>` | Find registered lookalike domains |
| `node agent.js detect-bec <file>` | Detect BEC indicators in email body |
| `node agent.js check-impersonation --email <file>` | Check executive impersonation |
| `node agent.js audit-rules --mailbox <addr>` | Generate mailbox audit commands |

### Examples

```bash
# Scan for registered lookalike domains
node agent.js scan-lookalikes company.com

# Analyze email body for BEC financial fraud patterns
node agent.js detect-bec /tmp/suspicious_email.txt

# Check email headers for impersonation
node agent.js check-impersonation --email /tmp/ceo_request.eml

# Generate PowerShell audit commands for mailbox
node agent.js audit-rules --mailbox ceo@company.com
```

## BEC Detection Rules (M365 Transport Rules)

| Rule | Condition | Action |
|---|---|---|
| Executive name from external | Display name matches exec + external sender | Prepend `[⚠ BEC WARNING]` |
| Reply-To mismatch | Reply-To domain ≠ From domain | Add X-header + flag |
| Wire transfer keywords | Body contains wire/ACH language from external | Route to SOC |
| New domain sender | Sender domain < 30 days old | Quarantine |

## External Tools

| Tool | Purpose |
|---|---|
| `dnstwist` | Lookalike domain generation and registration check |
| `whois` | Domain registration age verification |
| Exchange PowerShell | Mailbox rule and delegation auditing |
| Microsoft Defender for O365 | Anti-impersonation policies |
