Multi-source telemetry sharpens business email compromise detection

At a glance

What this is: This is a blog post on using multi-source telemetry to detect business email compromise by watching Office 365 mailbox activity and related security events.

Why it matters: It matters because business email compromise often abuses identity and mail workflows, so IAM, SOC, and detection teams need telemetry that links mailbox actions to response decisions.

👉 Read LimaCharlie’s analysis of multi-source telemetry for business email compromise

Context

Business email compromise is an identity-driven fraud problem as much as it is an email security problem. Attackers abuse legitimate mailbox actions, especially inbox rules and forwarding, to divert conversations and mask malicious activity. In environments that rely on Microsoft 365, those mailbox events become part of the access and accountability trail that security teams need to monitor.

The post argues for multi-source telemetry because no single log stream gives enough context to separate normal mailbox behaviour from abuse. That intersects with identity governance directly, since mailbox rules can become a low-friction persistence path once an account is compromised. For IAM and SOC teams, the issue is not simply collecting logs, but making identity-adjacent activity visible enough to drive containment and investigation.

Key questions

Q: How should security teams detect business email compromise without relying on payloads?

A: They should use behavioural signals such as sender history, thread context, request timing, and relationship baselines. Payload-less BEC often contains no malware, so content filters alone will miss it. The best controls compare the email against normal communication patterns and trigger response when the message departs from expected business behaviour.

Q: Why does business email compromise need identity telemetry as well as email logs?

A: BEC often begins with account compromise, but the fraud happens through legitimate mailbox actions. Identity telemetry shows who authenticated and from where, while email logs show what the account did next. Joining the two helps teams distinguish ordinary workflow from malicious persistence and diversion.

Q: What do security teams get wrong about inbox rule abuse?

A: They often treat it as an email housekeeping issue rather than a persistence and fraud technique. Inbox rules can hide messages, redirect payment conversations, and preserve attacker access after login. That makes them a governance and detection concern, not just a mailbox configuration detail.

Q: What should teams do when mailbox manipulation is detected?

A: They should contain the account, review recent sign-ins, inspect forwarding and inbox rules, and preserve mailbox activity for investigation before returning access. If the account supports finance, payroll, or vendor communications, the response should also include fraud checks on recent outbound requests and payment changes.

Technical breakdown

Mailbox rule abuse as a persistence mechanism

Business email compromise often relies on inbox rules, forwarding, or mailbox manipulation to maintain access after the attacker has captured a valid account. These actions are subtle because they use legitimate tenant features rather than noisy malware. In Office 365, events such as New-InboxRule can reveal that a mailbox has been altered to redirect, hide, or filter messages. The security value comes from correlating that event with other identity and mail activity, because the mailbox rule alone does not prove malicious intent.

Practical implication: monitor mailbox rule creation alongside sign-in and mail-delivery context so investigators can tell abuse from ordinary automation.

Why multi-source telemetry improves BEC detection

Multi-source telemetry combines signals from identity providers, email platforms, endpoint tools, cloud services, and response platforms into one analysis layer. That matters because BEC is rarely visible in a single dataset. A forwarding rule may be benign, but if it follows suspicious authentication, unusual device access, or atypical mailbox operations, the risk changes materially. The operational benefit is not volume, but correlation. Analysts can move from isolated events to a higher-confidence pattern that supports triage and containment.

Practical implication: build detections that join mailbox events with identity and endpoint context before escalating to incident response.

Mapping mailbox activity to attacker tradecraft

LimaCharlie links mailbox manipulation to MITRE ATT&CK technique T1114, which covers email collection and related abuse patterns. That mapping helps standardise detection logic and response language across teams. For BEC, the meaningful control question is whether analysts can see the sequence from account access to mailbox alteration to downstream fraud risk. In other words, telemetry must support a chain of evidence, not just an alert on one suspicious command.

Practical implication: align mailbox detections to ATT&CK so SOC and IAM teams use the same threat model when reviewing compromise indicators.

Threat narrative

Attacker objective: The attacker wants to use compromised mailbox control to redirect business communications and enable fraud.

1. Entry occurs when an attacker obtains a valid Microsoft 365 account and can operate within normal mailbox workflows.
2. Escalation happens when the attacker creates inbox rules or forwarding paths that hide messages and route communications away from the user.
3. Impact follows when those mailbox changes enable wire transfer fraud, invoice diversion, or further business email compromise.
4. The attacker objective is to preserve access to trusted email conversations long enough to manipulate payment or identity-related decisions.

NHI Mgmt Group analysis

Mailbox telemetry is now an identity control problem, not just a logging problem. Once an attacker can change inbox rules or forwarding paths, the mailbox becomes a persistence layer. That means identity and mail administrators need shared visibility into account activity, not separate views that leave gaps between authentication, message handling, and response. The practical conclusion is that BEC defence starts with identity-adjacent telemetry design.

Business email compromise exposes the gap between account access and account behaviour. Traditional IAM confirms whether a user can sign in, but BEC succeeds when the account behaves in ways that normal access reviews will not catch. That is why mailbox operations deserve the same scrutiny as privileged actions in other systems. Security teams should treat mailbox-rule abuse as a governance failure mode, not an email nuisance.

Multi-source correlation is the named concept that matters here: visibility trust gap. When mailbox, identity, and endpoint events live in separate tools, analysts inherit a trust gap between what the account was allowed to do and what it actually did. Closing that gap requires correlated telemetry and common threat language. Practitioners should design detections around behaviour, not around a single system event.

MITRE ATT&CK mapping improves consistency, but only if teams use it operationally. Tagging BEC activity to T1114 helps standardise triage, hunting, and reporting, yet the real value comes when detections feed response workflows. If alerting does not connect to identity investigation and mailbox containment, the mapping is descriptive rather than defensive. Practitioners should use ATT&CK as a bridge between IAM and SOC work.

For identity programmes, BEC is a reminder that human accounts still create non-human-like risk paths. A single compromised user can create automated forwarding or rule-based persistence that behaves like a lightweight workflow. That makes the boundary between human identity, mail systems, and automation more porous than many programmes assume. The practical implication is to govern mailbox actions as part of identity risk management, not as an isolated email control.

What this signals

Mailbox compromise is one of the clearest examples of why identity telemetry must extend beyond authentication events. Once an attacker can alter mail flow, the organisation is dealing with behaviour that sits between IAM, fraud, and SOC response. Teams that only review sign-ins will miss the persistence layer, especially where forwarded mail and inbox rules create hidden decision paths.

Visibility trust gap: when identity, mail, and endpoint telemetry remain disconnected, investigators cannot reliably tell which mailbox actions were authorised and which were abuse. That gap is operational, not theoretical. Security programmes should prioritise joined-up telemetry for users with financial authority, and they should align investigation workflows to NIST SP 800-53 Rev 5 Security and Privacy Controls where logging, audit, and access control overlap.

For practitioners

• Implement mailbox-rule detection coverage Monitor New-InboxRule, forwarding changes, and related mailbox operations in Microsoft 365, then correlate them with sign-in anomalies and privileged access context before deciding on escalation.
• Join identity and email telemetry Route identity provider, O365, endpoint, and response events into a single investigation workflow so analysts can see whether mailbox changes followed suspicious authentication or device activity.
• Tag BEC detections to ATT&CK Map mailbox manipulation alerts to T1114 and use that classification in playbooks, threat hunting, and analyst handoff notes.
• Review mailbox governance as identity governance Include mailbox forwarding, inbox rules, and account behaviour checks in periodic identity reviews for users who handle payments, invoices, or payroll decisions.

Key takeaways

• Business email compromise thrives when mailbox behaviour is not governed with the same rigor as account access.
• Correlating email, identity, and endpoint telemetry gives analysts the context needed to separate abuse from routine mailbox activity.
• Mailbox rules and forwarding paths should be treated as identity risk signals because they can create persistence and enable fraud.

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Mailbox Rule Abuse: Mailbox rule abuse occurs when an attacker creates or changes email rules to redirect, hide, or preserve messages. It is an identity risk because the attacker is using legitimate platform behaviour to maintain visibility and persistence after access, often without triggering obvious authentication alerts.
• Multi-source Telemetry: Multi-source telemetry is the practice of combining events from identity, endpoint, cloud, email, and response systems into one investigative view. It improves detection confidence by showing how actions relate across systems rather than forcing analysts to rely on a single log stream.
• Persistence: Persistence is the ability to retain memory, state, or goals across sessions and time. In NHI governance, persistence matters because retained context can influence later access decisions, create hidden privilege, and extend the impact of a prior task beyond its intended window.

What's in the full article

LimaCharlie’s full blog post covers the operational detection detail this post intentionally leaves for the source:

• Office 365 adapter workflow for bringing mailbox telemetry into a central analysis view
• Step-by-step detection logic for New-InboxRule and related mailbox operations
• Example response handling that tags suspicious activity for analyst review
• How to structure custom metadata so mailbox alerts support triage and investigation

👉 The full LimaCharlie post covers the Office 365 detection example, alert logic, and response handling details.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programme they operate.