Detecting Business Email Compromise
FreeIdentify and mitigate email fraud risks effectively.
Free · Opens the source repo
What Detecting Business Email Compromise does
The Detecting Business Email Compromise skill is designed to help organizations identify and respond to sophisticated email fraud schemes, specifically Business Email Compromise (BEC). BEC involves attackers impersonating executives, vendors, or trusted partners to deceive employees into making unauthorized wire transfers or disclosing sensitive information. Unlike traditional phishing attacks, BEC often relies solely on social engineering tactics and does not include malicious links or attachments, making it particularly insidious. This skill provides structured detection techniques that leverage email gateway rules, behavioral analytics, and financial process controls to combat these threats.
This skill is particularly useful for security operations center (SOC) analysts and organizations looking to enhance their email security posture. It guides users through the process of investigating suspected BEC incidents, creating detection rules, and validating existing security measures against BEC tactics. By implementing the recommended workflows, users can establish effective monitoring and response strategies to mitigate the risk of BEC attacks.
The skill outlines various types of BEC attacks, including CEO fraud, account compromise, and false invoice schemes. It also highlights key indicators of BEC attempts, such as urgency in communication, changes in payment instructions, and discrepancies in email domains. By following the provided workflows, users can configure specific email rules, deploy behavioral analytics to detect anomalies, and implement financial controls to safeguard against unauthorized transactions.
Overall, this skill is essential for organizations aiming to bolster their defenses against BEC, ensuring that employees are equipped to recognize and respond to potential fraud attempts. By fostering awareness and implementing structured detection strategies, businesses can significantly reduce their vulnerability to these sophisticated email threats.
When to use it
Use this skill when investigating suspicious emails that may involve executive or vendor impersonation, or when developing detection mechanisms for BEC-related threats.
When not to use it
This skill may not be appropriate for environments lacking email security gateways or those without established financial processes, as it relies on specific prerequisites for effective implementation.
What you can build with it
Investigating Suspicious Emails
Use this skill to analyze emails suspected of being part of a BEC attack, applying detection techniques to identify fraudulent attempts.
Building Detection Rules
Develop tailored detection rules based on the outlined workflows to enhance your organization's email security measures against BEC.
Training Security Teams
Leverage the skill's insights to train SOC analysts and finance teams on recognizing BEC indicators and implementing preventive measures.
How to install Detecting Business Email Compromise
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-business-email-compromise --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Business Email Compromise
Overview
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data, or changing payment details. Unlike traditional phishing, BEC often contains no malicious links or attachments, relying purely on social engineering. This skill covers detection techniques using email gateway rules, behavioral analytics, and financial process controls.
When to Use
- When investigating security incidents that require detecting business email compromise
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Email security gateway with BEC detection capabilities
- Understanding of organizational financial processes and approval chains
- Access to email logs and SIEM platform
- Knowledge of social engineering tactics
Key Concepts
BEC Attack Types (FBI IC3 Classification)
- CEO Fraud: Attacker impersonates CEO, requests urgent wire transfer
- Account Compromise: Employee email compromised, used to request payments from vendors
- False Invoice Scheme: Fake invoices from "vendor" with changed bank details
- Attorney Impersonation: Impersonates legal counsel for urgent confidential transfers
- Data Theft: Requests W-2, tax forms, or PII from HR
Detection Indicators
- Urgency and secrecy language ("confidential", "do not discuss with others")
- New or changed payment instructions
- Executive communication outside normal patterns
- Display name matches executive but email domain differs
- Reply-to address differs from From address
- First-time communication pattern between sender and recipient
- Request for gift cards or cryptocurrency
Workflow
Step 1: Configure BEC-Specific Email Rules
- Flag emails with VIP display names from external domains
- Detect financial keywords combined with urgency language
- Alert on first-time sender to finance/accounting staff
- Check for Reply-To domain mismatch
Step 2: Deploy Behavioral Analytics
- Baseline normal communication patterns per user
- Detect anomalous requests (unusual recipient, unusual time, unusual request type)
- Monitor for email forwarding rule changes (T1114.003)
Step 3: Implement Financial Controls
- Dual-authorization for wire transfers above threshold
- Out-of-band verification for payment detail changes (phone callback)
- Vendor payment change verification process
- Finance team training on BEC red flags
Step 4: Monitor for Account Compromise
- Detect impossible travel in email login locations
- Alert on email forwarding rule creation
- Monitor for mailbox delegation changes
- Check for inbox rules hiding BEC-related emails
Tools & Resources
- Microsoft Defender for O365 Anti-BEC: Built-in BEC detection
- Proofpoint Email Fraud Defense: BEC-specific solution
- Abnormal Security: AI-driven BEC detection
- FBI IC3 BEC Advisory: https://www.ic3.gov/
- FinCEN BEC Advisory: Financial institution guidance
Validation
- BEC detection rules trigger on test scenarios
- Financial controls prevent unauthorized transfers in drills
- Account compromise detection catches simulated attacks
- Reduced BEC susceptibility in awareness assessments
Frequently asked questions about Detecting Business Email Compromise
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.