What it does. Detect Business Email Compromise (BEC) fraud, where attackers impersonate Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-business-email-compromise, or copy the skill folder into ~/.claude/skills/detecting-business-email-compromise/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-business-email-compromise/SKILL.md

SKILL.md (verbatim)

name: detecting-business-email-compromise
description: Detect Business Email Compromise (BEC) fraud, where attackers impersonate
  executives or vendors to trick employees into wire transfers or data disclosure without
  malicious links, using email gateway rules, behavioral analytics, and financial process
  controls. Use when investigating a suspected executive/vendor impersonation email or
  building detection rules for social-engineering fund-transfer fraud.
domain: cybersecurity
subdomain: phishing-defense
tags:
- phishing
- email-security
- social-engineering
- dmarc
- awareness
- bec
- fraud
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0052
- AML.T0088
nist_ai_rmf:
- GOVERN-6.2
- MAP-5.2
d3fend_techniques:
- Restore Object
- Restore Configuration
- Application Configuration Hardening
- Application Hardening
- Disable Remote Access
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02
mitre_attack:
- T1566.002
- T1534
- T1114.002
- T1657
- T1078.004
mitre_f3:
  version: '1.1'
  tactics:
  - initial-access
  - positioning
  - monetization
  - stealth
  techniques:
  - id: T1672
    name: Email Spoofing
    tactic: stealth
    source: attack
  - id: F1032
    name: Impersonate Official
    tactic: initial-access
    source: f3
  - id: F1036
    name: New Vendor Setup
    tactic: positioning
    source: f3
  - id: F1005.006
    name: 'Account Manipulation: Change of Payment Details'
    tactic: positioning
    source: f3
  - id: F1025.003
    name: 'Electronic Funds Transfer: Wire Transfer'
    tactic: monetization
    source: f3
  - id: F1022
    name: Delete Relevant Emails
    tactic: stealth
    source: f3

Detecting Business Email Compromise

Overview

Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data, or changing payment details. Unlike traditional phishing, BEC often contains no malicious links or attachments, relying purely on social engineering. This skill covers detection techniques using email gateway rules, behavioral analytics, and financial process controls.

When to Use

• When investigating security incidents that require detecting business email compromise
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Email security gateway with BEC detection capabilities
• Understanding of organizational financial processes and approval chains
• Access to email logs and SIEM platform
• Knowledge of social engineering tactics

Key Concepts

BEC Attack Types (FBI IC3 Classification)

1. CEO Fraud: Attacker impersonates CEO, requests urgent wire transfer
2. Account Compromise: Employee email compromised, used to request payments from vendors
3. False Invoice Scheme: Fake invoices from "vendor" with changed bank details
4. Attorney Impersonation: Impersonates legal counsel for urgent confidential transfers
5. Data Theft: Requests W-2, tax forms, or PII from HR

Detection Indicators

• Urgency and secrecy language ("confidential", "do not discuss with others")
• New or changed payment instructions
• Executive communication outside normal patterns
• Display name matches executive but email domain differs
• Reply-to address differs from From address
• First-time communication pattern between sender and recipient
• Request for gift cards or cryptocurrency

Workflow

Step 1: Configure BEC-Specific Email Rules

• Flag emails with VIP display names from external domains
• Detect financial keywords combined with urgency language
• Alert on first-time sender to finance/accounting staff
• Check for Reply-To domain mismatch

Step 2: Deploy Behavioral Analytics

• Baseline normal communication patterns per user
• Detect anomalous requests (unusual recipient, unusual time, unusual request type)
• Monitor for email forwarding rule changes (T1114.003)

Step 3: Implement Financial Controls

• Dual-authorization for wire transfers above threshold
• Out-of-band verification for payment detail changes (phone callback)
• Vendor payment change verification process
• Finance team training on BEC red flags

Step 4: Monitor for Account Compromise

• Detect impossible travel in email login locations
• Alert on email forwarding rule creation
• Monitor for mailbox delegation changes
• Check for inbox rules hiding BEC-related emails

Tools & Resources

• Microsoft Defender for O365 Anti-BEC: Built-in BEC detection
• Proofpoint Email Fraud Defense: BEC-specific solution
• Abnormal Security: AI-driven BEC detection
• FBI IC3 BEC Advisory: https://www.ic3.gov/
• FinCEN BEC Advisory: Financial institution guidance

Validation

• BEC detection rules trigger on test scenarios
• Financial controls prevent unauthorized transfers in drills
• Account compromise detection catches simulated attacks
• Reduced BEC susceptibility in awareness assessments

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

BEC Detection and Response Template

VIP Protection List

BEC Detection Rules Deployed

Financial Controls

• Dual authorization for transfers > $[threshold]
• Out-of-band verification for payment detail changes
• Vendor payment change requires callback on known number
• Gift card purchases require in-person manager approval

BEC Incident Response Contacts

references/api-reference.md (verbatim)

API Reference: Detecting Business Email Compromise

Python email Library

import email
from email import policy

# Parse .eml file
with open("message.eml") as f:
    msg = email.message_from_file(f, policy=policy.default)

msg.get("From")                # sender header
msg.get("Reply-To")            # reply-to header
msg.get("Authentication-Results")  # SPF/DKIM/DMARC results
body = msg.get_body(preferencelist=("plain", "html"))
body.get_content()             # decoded body text

Authentication Header Patterns

BEC Attack Types (FBI IC3)

BEC Indicator Regex Patterns

# Financial urgency
r"\b(wire transfer|bank transfer|routing number)\b"
# Secrecy pressure
r"\b(confidential|do not share|keep this between us)\b"
# Gift card fraud
r"\b(gift card|bitcoin|crypto|western union)\b"
# Account change
r"\b(change.*(bank|account|payment))\b"

Microsoft Graph API - Mail Security

GET https://graph.microsoft.com/v1.0/me/messages?$filter=internetMessageHeaders/any(h: h/name eq 'Authentication-Results')
Authorization: Bearer {token}

CLI Usage

python agent.py --email-file suspicious.eml --vip-names "John Smith" "Jane CEO"
python agent.py --scan-dir /var/mail/quarantine/ --vip-names "CFO Name"

references/standards.md (verbatim)

Standards & References: Detecting Business Email Compromise

FBI IC3 BEC Classification

• Type 1: CEO Fraud / Executive Impersonation
• Type 2: Account Compromise (compromised employee email)
• Type 3: False Invoice / Vendor Email Compromise
• Type 4: Attorney Impersonation
• Type 5: Data Theft (W-2/PII requests)

MITRE ATT&CK References

• T1566.001/002: Phishing (initial access for BEC)
• T1534: Internal Spearphishing
• T1114.003: Email Collection: Email Forwarding Rule
• T1098.002: Account Manipulation: Additional Email Delegate Access
• T1586.002: Compromise Accounts: Email Accounts

NIST / Regulatory

• NIST SP 800-177 Rev.1: Trustworthy Email
• FinCEN Advisory FIN-2019-A005: Advisory on BEC targeting businesses
• FBI IC3 Annual Report: BEC statistics and trends ($2.9B losses in 2023)

Detection Rule Categories

references/workflows.md (verbatim)

Workflows: Detecting Business Email Compromise

Workflow 1: BEC Detection Pipeline

Inbound email arrives
  |
  v
[Check: Does display name match VIP list?]
  +-- YES + external domain --> HIGH ALERT: Possible CEO fraud
  +-- NO --> Continue standard checks
  |
  v
[Check: Financial keywords present?]
  +-- "wire transfer", "payment", "invoice", "bank details" detected
  +-- Combined with urgency: "urgent", "confidential", "today"
  +-- YES --> ELEVATED: Flag for finance team review
  |
  v
[Check: Reply-To mismatch?]
  +-- Reply-To domain differs from From domain
  +-- YES --> HIGH: Likely BEC attempt
  |
  v
[Check: Communication pattern anomaly?]
  +-- First-time sender to finance/HR staff
  +-- Unusual time of day for this sender
  +-- YES --> MEDIUM: Requires verification
  |
  v
[Decision]
  +-- BLOCK: High-confidence BEC
  +-- QUARANTINE: Moderate confidence
  +-- TAG: Warning banner for recipient
  +-- DELIVER: Low risk

Workflow 2: BEC Incident Response

BEC attempt detected or reported
  |
  v
[Immediate actions (first 30 minutes)]
  +-- Quarantine the email
  +-- Search for similar messages to other recipients
  +-- Alert affected users not to comply with request
  |
  v
[Investigation (next 2 hours)]
  +-- Analyze email headers for true origin
  +-- Check if any user already complied (check sent folders)
  +-- If payment was made: Initiate bank recall immediately
  +-- Search for compromised accounts (forwarding rules, login anomalies)
  |
  v
[Containment]
  +-- Block sender domain/IP
  +-- If account compromised: Force password reset, revoke sessions
  +-- Remove malicious forwarding rules
  +-- Notify finance to halt pending payments
  |
  v
[Recovery]
  +-- Work with bank for fund recovery
  +-- File FBI IC3 report (ic3.gov)
  +-- Notify affected parties
  +-- Update detection rules
  +-- Targeted training for affected employees

Workflow 3: Vendor Payment Change Verification

Vendor requests payment detail change
  |
  v
[Do NOT use contact info from the email]
  |
  v
[Look up vendor contact from existing records]
  |
  v
[Call vendor using known phone number]
  +-- Verify the payment change request is legitimate
  |
  +-- CONFIRMED --> Process change with dual authorization
  +-- NOT CONFIRMED --> Report as BEC attempt, block sender
  +-- UNABLE TO REACH --> Hold payment, escalate

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.