Multi-source telemetry sharpens business email compromise detection

At a glance

What this is: This is a detection-focused blog post arguing that multi-source telemetry makes business email compromise easier to identify by putting mailbox and identity activity into one analysable view.

Why it matters: It matters because IAM, SOC, and email security teams need correlation across identity and mail events to catch inbox rule abuse, forwarding abuse, and other BEC precursors before fraud occurs.

Context

Business email compromise is a detection problem as much as a fraud problem. Mailbox rule abuse, forwarding changes, and related identity activity are often individually low-signal, but together they form a pattern that security teams can use to distinguish normal admin behaviour from account takeover and financial fraud.

The article’s core governance gap is visibility fragmentation. When email, identity, and endpoint telemetry are analysed separately, analysts must reconstruct the story after the fact rather than observe the attack path in time to respond. For organisations running Microsoft 365 or similar environments, that makes mailbox activity a practical identity-security concern, not just an email-security one.

Key questions

Q: What should security teams do first when inbox rules start changing unexpectedly?

A: Start by validating whether the rule change is a normal user action or part of account compromise. Then check the source identity, device, and recent mailbox activity together, because isolated mail events rarely tell the full story. If the change hides messages or redirects business correspondence, treat it as a fraud-control event as well as an email-security alert.

Q: Why do malicious mail rules increase the impact of business email compromise?

A: Malicious mail rules matter because they let attackers automate stealth, exfiltration, and persistence after they get into a mailbox. A rule can hide warning messages, forward sensitive mail to an external account, or delete messages from specific senders. That gives the attacker time to impersonate executives, monitor investigations, and continue harvesting data even if the victim changes their password.

Q: What are the signs that email telemetry is not good enough for BEC detection?

A: Warning signs include frequent false positives, alerts that cannot be tied to a person or device, and mailbox events that analysts cannot connect to business context. If a team sees inbox-rule activity but cannot tell whether it supports fraud, admin work, or compromise, telemetry is too fragmented to drive reliable response.

Q: How should SOC and IAM teams share responsibility for mailbox abuse?

A: SOC should triage the alert and contain the suspicious activity, while IAM should verify whether the account, session, or mailbox control state has been altered in ways that create future abuse. The best operating model treats mailbox manipulation as an identity event with fraud consequences, not as a single-team problem.

Technical breakdown

Mailbox rule abuse as a BEC indicator

Business email compromise often begins with mailbox manipulation rather than obvious malware. Attackers create inbox rules, forwarding rules, or related mailbox operations to divert messages away from the victim’s view and keep payment, invoice, or payroll threads under attacker control. In Microsoft 365 environments, those actions may appear as ordinary administrative events unless the detection logic is built around the operation itself and the surrounding identity context. The technical challenge is not logging alone. It is identifying which mailbox operations are unusual enough to represent a fraud path rather than a routine user action.

Practical implication: write detections around mailbox rule creation and forwarding changes, not just generic login anomalies.

Why multi-source telemetry improves detection fidelity

Multi-source telemetry works because BEC is multi-step. A suspicious mailbox action becomes far more meaningful when paired with identity, endpoint, or cloud context that shows who acted, from where, and what changed before or after the event. That reduces false positives and helps analysts see whether the mailbox event fits a broader compromise pattern. The value is not simply centralisation. It is correlation across sources so a weak signal in one stream becomes a stronger control signal when matched with another. This is especially useful in hybrid environments where users, mail, and infrastructure sit across different platforms.

Practical implication: correlate email events with identity and endpoint telemetry before escalating mailbox-rule alerts.

MITRE ATT&CK mapping gives detections operational meaning

Mapping mailbox manipulation to a technique such as MITRE ATT&CK T1114 gives the alert more than a label. It ties the event to a known adversary behaviour pattern that SOC teams can triage, hunt for, and measure consistently. That matters because teams need to know whether they are seeing a benign rule change, an early-stage BEC attempt, or a mailbox-control technique that supports fraud persistence. Technique mapping also helps standardise response language between email security, IAM, and SOC functions, which is often where detection programmes lose momentum.

Practical implication: tag mailbox manipulation alerts to a common adversary technique so SOC and IAM teams use the same response language.

Threat narrative

Attacker objective: The attacker’s objective is to control business email threads long enough to divert payments or perpetrate wire transfer fraud without the victim noticing.

1. Entry begins with mailbox access or a compromised email account that lets the attacker interact with the victim’s inbox.
2. Credential or account control is then used to create inbox rules or forwarding logic that hides incoming messages and preserves visibility for the attacker.
3. Impact follows when invoices, payroll changes, or financial correspondence are redirected into a fraud workflow that supports wire transfer abuse.

Breaches seen in the wild

• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Multi-source telemetry is now a governance requirement for BEC detection: isolated mailbox logs rarely provide enough context to distinguish normal rule changes from compromise. Correlating identity, mail, and endpoint activity turns a low-signal event into a usable security signal. For practitioners, the governance question is whether detection logic reflects the real attack path rather than a single data source.

Email security and IAM are converging at the mailbox: inbox rules, forwarding changes, and mailbox operations are not just email events, they are access and control events. That makes them relevant to identity governance, because a compromised account can reshape the flow of business communications without changing the underlying authentication state. Teams should treat mailbox control changes as part of identity risk monitoring, not a separate afterthought.

Mailbox manipulation should be treated as a named fraud-control concept: the most useful concept here is mailbox control drift, meaning the point at which message routing no longer reflects the user’s intended access. Once that drift exists, attackers can hide correspondence while staying inside legitimate SaaS controls. Practitioners should build detections that surface this drift early, before fraud workflows mature.

ATT&CK mapping matters because it aligns detection with response: mapping email abuse to a common adversary technique helps analysts communicate across SOC, IAM, and fraud teams. Without that shared taxonomy, organisations detect events but fail to prioritise them consistently. The practical outcome is a more disciplined triage model for BEC-related mailbox activity.

Visibility alone is not the end state: telemetry only becomes useful when it is organised into response-ready workflows that can inform analyst decisions quickly. For identity and security teams, that means the control objective is not log collection but usable context around who changed mailbox behaviour, when, and why.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide

What this signals

Mailbox control drift: the most useful operational concept here is the point at which mail routing no longer reflects the owner’s intent. Teams that only watch sign-in behaviour will miss that drift, while teams that watch mailbox actions in context can interrupt fraud before invoices or payroll threads are redirected.

For IAM and SOC teams, the practical shift is toward response-ready visibility rather than raw event collection. The more useful telemetry is the telemetry that lets an analyst confirm who changed a rule, how that rule altered communication flow, and whether the change fits a known BEC pattern.

For practitioners

• Detect mailbox rule creation and forwarding changes Build alerts around New-InboxRule, forwarding updates, and related mailbox operations in Microsoft 365 or equivalent mail systems. Prioritise changes that route messages outside normal business paths or suppress visibility for the mailbox owner.
• Correlate email and identity telemetry Join mailbox events with identity, device, and cloud context so analysts can see who made the change, from where, and what happened immediately before and after it. This reduces false positives and makes compromise patterns easier to confirm.
• Tag detections to a shared adversary technique Map mailbox manipulation alerts to a common ATT&CK technique reference so SOC, IAM, and fraud teams use consistent triage language. That keeps response aligned when the same mailbox event is relevant to both account compromise and business fraud.
• Review privileged mailbox administration paths Separate routine user rule changes from administrative actions that can alter inbox behaviour at scale. Ensure privileged mail workflows are monitored with the same attention as other high-risk identity operations.

Key takeaways

• Business email compromise often hides inside ordinary mailbox operations, which makes rule changes and forwarding abuse more important than single-event login alerts.
• Only 5.7% of organisations have full visibility into their service accounts, a useful reminder that hidden control paths remain common across identity programmes.
• The strongest detection programmes join email, identity, and device telemetry so analysts can confirm fraud patterns quickly and respond with consistent triage language.

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Inbox Rule Abuse: The misuse of email filtering rules to hide, redirect, or suppress messages after an account has been accessed. In Exchange, these rules can become persistence and exfiltration mechanisms when they are created inside a legitimate mailbox context and are not monitored for malicious action patterns.
• Multi-source Telemetry: Multi-source telemetry is the practice of combining events from identity, endpoint, cloud, email, and response systems into one investigative view. It improves detection confidence by showing how actions relate across systems rather than forcing analysts to rely on a single log stream.
• Mailbox Control Drift: The point at which mailbox routing, access, or message handling no longer reflects the owner’s intent. It is a useful governance concept because it captures how attackers can change business communication flow without fully replacing the account or triggering obvious authentication alarms.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for teams that need to connect identity controls to real operational risk across modern environments.