What it does. Deploy AI and NLP-powered detection systems to identify business email Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-business-email-compromise-with-ai, or copy the skill folder into ~/.claude/skills/detecting-business-email-compromise-with-ai/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise-with-ai/SKILL.md
SKILL.md (verbatim)
name: detecting-business-email-compromise-with-ai
description: Deploy AI and NLP-powered detection systems to identify business email
compromise attacks by analyzing writing style, behavioral patterns, and contextual
anomalies that evade traditional rule-based filters.
domain: cybersecurity
subdomain: phishing-defense
tags:
- bec
- ai
- nlp
- machine-learning
- email-security
- behavioral-analytics
- impersonation
- fraud-detection
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0073
- AML.T0052
- AML.T0088
nist_ai_rmf:
- GOVERN-6.2
- MAP-5.2
- GOVERN-6.1
- MEASURE-2.7
- MEASURE-2.5
d3fend_techniques:
- Sender MTA Reputation Analysis
- Email Filtering
- Sender Reputation Analysis
- Homoglyph Detection
- Message Analysis
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02
mitre_attack:
- T1566.002
- T1534
- T1114.002
- T1657
- T1078.004
mitre_f3:
version: '1.1'
tactics:
- initial-access
- stealth
- positioning
- monetization
techniques:
- id: T1660
name: Phishing
tactic: initial-access
source: attack
- id: T1672
name: Email Spoofing
tactic: stealth
source: attack
- id: F1032
name: Impersonate Official
tactic: initial-access
source: f3
- id: F1005.006
name: 'Account Manipulation: Change of Payment Details'
tactic: positioning
source: f3
- id: F1022
name: Delete Relevant Emails
tactic: stealth
source: f3
- id: F1025.003
name: 'Electronic Funds Transfer: Wire Transfer'
tactic: monetization
source: f3
Detecting Business Email Compromise with AI
Overview
AI-powered BEC detection uses machine learning, NLP, and behavioral analytics to identify sophisticated impersonation attacks that contain no malicious links or attachments. Traditional rule-based filters miss these attacks because BEC relies purely on social engineering. Modern AI approaches analyze writing style, tone, vocabulary, grammatical patterns, and behavioral context to determine if an email genuinely comes from the stated sender. BERT-based models achieve 98.65% accuracy in BEC detection, and AI-enhanced platforms show a 25% increase in phishing identification over keyword-based rules.
When to Use
- When investigating security incidents that require detecting business email compromise with ai
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- AI-powered email security platform (Abnormal Security, Tessian, Microsoft Defender)
- Historical email data for baseline training (minimum 30 days)
- Integration with email platform (Microsoft 365 or Google Workspace)
- SIEM for alert correlation and investigation
- Understanding of BEC attack types (FBI IC3 classification)
Workflow
- Select API-based solution (Abnormal Security, Tessian, Ironscales) or enhance existing SEG
- Connect to Microsoft Graph API or Google Workspace API
- Allow 48-hour baseline learning period on historical email data
- Configure integration to scan inbound, outbound, and internal email
- Verify API permissions for message access and remediation
- AI learns normal communication patterns: who emails whom, frequency, tone
- Establish writing style profiles for each user (vocabulary, sentence structure)
- Map typical request types per role (finance processes payments, HR handles PII)
- Baseline email metadata: typical sending times, devices, locations
- Flag deviations from established baselines as anomalous
Step 3: Train NLP Models for BEC Detection
- Deploy transformer-based models (BERT, GPT) for email content analysis
- Detect urgency and manipulation language patterns
- Identify mismatches between sender identity and writing style
- Analyze sentiment shifts indicating social engineering pressure
- Classify email intent: information request, payment request, credential request
- VIP impersonation: AI compares new email against known executive communication patterns
- Vendor impersonation: detect payment change requests from vendor lookalike domains
- Account compromise: detect sudden changes in employee email behavior
- Supply chain BEC: monitor for impersonation of trusted partners
- Configure confidence thresholds for auto-block vs. warning banner vs. analyst review
Step 5: Integrate with Response Workflow
- Auto-quarantine high-confidence BEC detections
- Add warning banners for moderate-confidence detections
- Route suspicious emails to SOC analyst queue for review
- Integrate with SOAR for automated response playbooks
- Feed BEC verdicts back into training data for model improvement
- Abnormal Security: API-based AI email security with behavioral analysis
- Microsoft Defender for O365: Built-in AI anti-BEC with Impostor Classifier
- Tessian (Proofpoint): AI-powered email security with human layer protection
- Ironscales: AI + human-in-the-loop BEC detection
- Darktrace Email: Self-learning AI for email threat detection
Validation
- AI detects test BEC email with no malicious indicators (pure social engineering)
- Writing style analysis identifies impersonation of known executive
- Behavioral baseline flags unusual payment request from compromised account
- NLP correctly classifies urgency manipulation in test scenario
- False positive rate below 0.05% after baseline training
- Detection rate exceeds traditional rule-based filters by 25%+
Other files in this skill
assets/template.md (verbatim)
AI-Powered BEC Detection Template
| Setting |
Value |
Status |
| Platform |
|
|
| Integration |
API-based (Microsoft Graph) |
|
| Baseline training period |
30+ days |
|
| Scanning scope |
Inbound + Internal + Outbound |
|
Detection Thresholds
| Score Range |
Classification |
Action |
| 90-100% |
High-confidence BEC |
Auto-quarantine + SOC alert |
| 70-89% |
Moderate BEC |
Warning banner + analyst queue |
| 50-69% |
Low-confidence BEC |
Warning banner only |
| < 50% |
Likely legitimate |
Deliver normally |
VIP Protection List
| Name |
Title |
Email |
Writing Style Profiled |
|
CEO |
|
|
|
CFO |
|
|
|
CTO |
|
|
| Metric |
Target |
Current |
| Detection accuracy |
> 98% |
|
| False positive rate |
< 0.05% |
|
| Mean detection time |
< 5 sec |
|
| BEC catch rate vs. rules |
+25% |
|
references/api-reference.md (verbatim)
API Reference: Detecting BEC with AI
| Feature |
Description |
BEC Signal |
| urgency_score |
Ratio of urgency words to total |
High = suspicious |
| pressure_score |
Ratio of secrecy/pressure words |
High = suspicious |
| financial_score |
Ratio of financial terms |
High = suspicious |
| authority_score |
Ratio of executive title mentions |
High = suspicious |
| caps_ratio |
Uppercase character ratio |
High = aggressive tone |
| unique_word_ratio |
Vocabulary diversity metric |
Low = template-like |
scikit-learn Classification Pipeline
from sklearn.pipeline import Pipeline
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.ensemble import RandomForestClassifier
pipeline = Pipeline([
("tfidf", TfidfVectorizer(max_features=5000, ngram_range=(1, 2))),
("clf", RandomForestClassifier(n_estimators=100, random_state=42))
])
pipeline.fit(X_train, y_train)
predictions = pipeline.predict(X_test)
Writing Style Analysis (Stylometry)
# Sentence length distribution for author verification
import re, math
sentences = re.split(r'[.!?]+', text)
lengths = [len(s.split()) for s in sentences if s.strip()]
mean_len = sum(lengths) / len(lengths)
variance = sum((l - mean_len)**2 for l in lengths) / len(lengths)
std_dev = math.sqrt(variance)
Microsoft Graph API - Suspicious Mail Rules
GET https://graph.microsoft.com/v1.0/users/{id}/mailFolders/inbox/messageRules
Authorization: Bearer {token}
# Detect forwarding rules (T1114.003)
GET https://graph.microsoft.com/v1.0/users/{id}/mailFolders/inbox/messageRules?$filter=actions/forwardTo ne null
Impersonation Signal Patterns
# Mobile signature (creates urgency excuse)
r"sent from my (iphone|ipad|android|mobile)"
# Discourages verification
r"(please|kindly).*(do not|don't).*(reply|respond|call)"
# Unavailability excuse
r"(i am|i'm).*(in a meeting|traveling|on a flight)"
# Time pressure
r"(handle|process|complete).*(today|immediately|by end of day)"
CLI Usage
python agent.py --file email_body.txt
python agent.py --file email_body.txt --baseline-file sender_style.json
references/standards.md (verbatim)
Standards & References: Detecting BEC with AI
MITRE ATT&CK References
- T1566.001/002: Phishing (Spearphishing Attachment/Link)
- T1534: Internal Spearphishing
- T1656: Impersonation
- T1586.002: Compromise Accounts: Email Accounts
- T1114.003: Email Collection: Email Forwarding Rule
AI/ML Techniques for BEC Detection
| Technique |
Application |
Accuracy |
| BERT embeddings + SVC |
Email classification |
98.65% |
| Transformer NLP |
Writing style analysis |
96%+ |
| Anomaly detection |
Behavioral baseline deviation |
94%+ |
| Graph neural networks |
Communication pattern analysis |
93%+ |
| Sentiment analysis |
Urgency/manipulation detection |
91%+ |
FBI IC3 BEC Statistics
- $2.9 billion losses reported in 2023
- BEC accounts for 27% of all cybercrime financial losses
- Average loss per BEC incident: $125,000
- 21,832 BEC complaints filed in 2023
Detection Categories
- Impostor Detection: AI identifies display name/domain impersonation
- Account Takeover Detection: Behavioral anomalies from compromised accounts
- Writing Style Analysis: NLP compares email to sender's historical style
- Intent Classification: ML classifies email as payment/credential/data request
- Relationship Analysis: Graph analysis of sender-recipient communication patterns
references/workflows.md (verbatim)
Workflows: Detecting BEC with AI
Workflow 1: AI-Powered BEC Detection Pipeline
Inbound email arrives
|
v
[Feature extraction]
+-- Sender metadata (domain, IP, authentication)
+-- Email content (subject, body, NLP features)
+-- Behavioral context (communication history, timing)
+-- Relationship graph (sender-recipient pattern)
|
v
[Multi-model analysis (parallel)]
+-- Impostor classifier: Display name/domain impersonation
+-- NLP model: Writing style vs. sender baseline
+-- Behavioral model: Request anomaly detection
+-- Intent classifier: Payment/credential/data request
|
v
[Confidence scoring]
+-- Aggregate model outputs
+-- Weight by model confidence and context
+-- Generate overall BEC probability score
|
v
[Action]
+-- Score >= 90%: Auto-quarantine + SOC alert
+-- Score 70-89%: Warning banner + analyst queue
+-- Score 50-69%: Warning banner only
+-- Score < 50%: Deliver normally
Workflow 2: Model Feedback Loop
BEC verdict generated
|
v
[User/analyst feedback]
+-- User reports false positive (legitimate email flagged)
+-- Analyst confirms true positive (BEC caught)
+-- User reports missed BEC (false negative)
|
v
[Feedback integration]
+-- Update sender trust score
+-- Retrain model with corrected labels
+-- Adjust confidence thresholds
+-- Update behavioral baselines
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.