BEC follows a script: get in, persist quietly, watch, then strike (invoice fraud, wire redirection). Each step has a mailbox-level signature and a detection — the anatomy that turns 'the CEO got hacked' into a repeatable response.
The flow — what actually happens
Plain-language first; the packet-level
view underneath each step is what you'd see in a Wireshark trace, and what healthy looks like.
-
Entry
Phished creds (often via a Teams or mail lure — the Copilot/Teams security concepts), MFA fatigue, or token theft. The attacker now IS the user, with all their access and none of the anomaly a new device usually triggers — if MFA was satisfied.
On the wire Entra sign-in logs: the impossible-travel, the new ASN, the MFA-satisfied-from-nowhere event. This is where BEC is cheapest to catch — before it touches a mailbox.
-
Persistence and concealment
First moves are always the same: an INBOX RULE that files/deletes security notifications and replies (so the victim never sees the conversation the attacker is having as them), sometimes a forwarding address, sometimes an OAuth app grant for token-persistence past a password reset.
On the wire New-InboxRule audit events, mailbox-forwarding changes, and OAuth consent grants — the three highest-signal BEC events; a rule named ' ' or '.' moving mail to RSS Feeds is the classic tell.
-
Reconnaissance
The attacker reads: finance threads, invoice formats, who authorises what, the CEO's writing style, the supplier relationships. Quiet, patient, often days — using YOUR mailbox search to find the payload. (Copilot makes this faster, the oversharing concept's threat edition — mail edition here.)
On the wire Mailbox audit read/search events at anomalous volume/pattern; the account touching finance folders it never opened before — insider-risk-shaped signals on a compromised insider.
-
The strike
A crafted mail: 'updated bank details for the invoice', wire-transfer urgency, the supplier thread hijacked mid-conversation with a lookalike domain for external legs. The money moves before anyone in the loop suspects the sender isn't the sender.
On the wire Outbound trace to finance/suppliers, the lookalike-domain external send (impersonation protection's job — anti-phish concept), and often a spike that trips outbound reputation (the deliverability smoke of a compromise).
Discussion
No messages yet — start the thread.
