<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-business-email-compromise
description: >-
  Detect and investigate Business Email Compromise (BEC) and Vendor Email
  Compromise (VEC) attacks. Covers display name spoofing, lookalike domain
  detection, mailbox rule auditing, impossible travel analysis, and
  financial fraud prevention workflows.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - bec
  - vec
  - business-email-compromise
  - email-fraud
  - wire-transfer-fraud
  - display-name-spoofing
  - lookalike-domains
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1534"]
---

# Detecting Business Email Compromise

## Overview

BEC attacks exploit trust relationships to trick employees into transferring
funds, sharing sensitive data, or modifying payment details. Unlike mass phishing,
BEC is targeted and often involves compromised accounts or spoofed executive
identities. This skill covers detection of display name spoofing, lookalike
domains, mailbox rule abuse, and financial fraud patterns.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `dnstwist` | `pip install dnstwist` |
| M365 PowerShell | `Install-Module ExchangeOnlineManagement` |
| DNS tools | `dig`, `whois` |
| Email gateway access | Transport rule configuration |

## Key Concepts

### BEC Attack Types (FBI Classification)

| Type | Description | Target |
|---|---|---|
| CEO Fraud | Impersonate executive requesting wire transfer | Finance team |
| Invoice Fraud | Modify vendor payment details | Accounts payable |
| Account Compromise | Use compromised mailbox to request payments | Internal contacts |
| Attorney Impersonation | Pose as legal counsel for urgent transfer | Executives |
| Data Theft | Request W-2 or PII from HR | HR/payroll |
| Vendor Email Compromise | Compromise vendor to redirect payments | Supply chain |

### Detection Signals

```
High Confidence Indicators:
├── From display name matches executive, domain is external
├── Reply-To domain differs from From domain
├── New mailbox forwarding rule to external address
├── Wire transfer request with urgency language
├── Payment detail change request from vendor domain lookalike
└── Impossible travel on email account authentication

Medium Confidence Indicators:
├── First-time sender to financial contact
├── Email bypasses normal approval workflow
├── Request to keep transaction confidential
├── Domain registered within 30 days
└── Account accessed from anonymous VPN/Tor
```

### Lookalike Domain Techniques

```
Original: company.com

Homograph:     cornpany.com  (rn → m visual)
Typosquat:     comapny.com   (transposition)
TLD swap:      company.net   (different TLD)
Hyphenation:   company-inc.com
Subdomain:     company.com.evil.com
Character sub: c0mpany.com   (o → 0)
Addition:      companys.com
```

## Workflow

### 1. Lookalike Domain Monitoring

```bash
# Generate and check lookalike domains
dnstwist --registered --format json company.com > /tmp/lookalikes.json

# Monitor for new registrations (run weekly via cron)
node agent.js scan-lookalikes company.com

# Check specific suspicious domain
whois suspicious-company.com | grep -i 'creation\|registrant'
```

### 2. Mailbox Rule Auditing

```bash
# M365: Check for suspicious forwarding rules
# Get-InboxRule -Mailbox ceo@company.com | Where-Object {$_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo}

# Check transport rules for unauthorized redirects
# Get-TransportRule | Where-Object {$_.RedirectMessageTo -ne $null}

# Audit mailbox delegations
# Get-MailboxPermission -Identity ceo@company.com | Where-Object {$_.AccessRights -like "*FullAccess*"}

# Agent-based rule audit
node agent.js audit-rules --mailbox ceo@company.com
```

### 3. Executive Impersonation Detection

```bash
# Create transport rule for display name spoofing detection
# New-TransportRule -Name "BEC: Executive Name from External" \
#   -FromScope NotInOrganization \
#   -HeaderMatchesMessageHeader "From" \
#   -HeaderMatchesPatterns "CEO Name|CFO Name" \
#   -SetHeaderName "X-BEC-Warning" \
#   -SetHeaderValue "Executive name from external sender" \
#   -PrependSubject "[⚠ EXTERNAL - Possible BEC] "

node agent.js check-impersonation --email suspect_email.eml
```

### 4. Financial Request Analysis

```bash
# Analyze email for BEC financial fraud indicators
node agent.js analyze-financial /tmp/suspect_email.txt

# Check for urgency and payment language patterns
node agent.js detect-bec /tmp/email_body.txt
```

## Detection

```yaml
title: Business Email Compromise Detection
id: 2433c8d8-442a-4653-b6f6-48685db6ab03
status: experimental
description: Detects suspicious activity related to detecting business email compromise techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1534
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Lookalike domains monitored | `dnstwist` running weekly with alerting |
| Display name rules active | Transport rules flagging executive names from external |
| Mailbox rules audited | No unauthorized forwarding rules |
| Financial request workflow | Wire transfers require out-of-band verification |
| Impossible travel alerts | Conditional access or UEBA alerting configured |
| Vendor payment changes | Require callback verification on new bank details |

## References

- [FBI IC3 BEC Advisory](https://www.ic3.gov/Media/Y2023/PSA230609)
- [MITRE T1566.002 — Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
- [MITRE T1114 — Email Collection](https://attack.mitre.org/techniques/T1114/)
- [dnstwist Documentation](https://github.com/elceef/dnstwist)
- [Microsoft BEC Protection](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-about)
