Notifications
Clear all
Topic starter
01/08/2026 10:43 pm
TL;DR: Multi-source telemetry gives security teams the visibility needed to detect business email compromise patterns such as mailbox rule manipulation and email forwarding abuse, according to LimaCharlie. The real lesson is that detection quality depends on consolidating identity and mail activity into a response-ready view, not on collecting more logs alone.
NHIMG editorial — based on content published by LimaCharlie: Multi-source telemetry for finding business email compromise
Questions worth separating out
Q: How should security teams detect business email compromise without relying on payloads?
A: They should use behavioural signals such as sender history, thread context, request timing, and relationship baselines.
Q: Why does business email compromise need identity telemetry as well as email logs?
A: BEC often begins with account compromise, but the fraud happens through legitimate mailbox actions.
Q: What do security teams get wrong about inbox rule abuse?
A: They often treat it as an email housekeeping issue rather than a persistence and fraud technique.
Practitioner guidance
- Implement mailbox-rule detection coverage Monitor New-InboxRule, forwarding changes, and related mailbox operations in Microsoft 365, then correlate them with sign-in anomalies and privileged access context before deciding on escalation.
- Join identity and email telemetry Route identity provider, O365, endpoint, and response events into a single investigation workflow so analysts can see whether mailbox changes followed suspicious authentication or device activity.
- Tag BEC detections to ATT&CK Map mailbox manipulation alerts to T1114 and use that classification in playbooks, threat hunting, and analyst handoff notes.
What's in the full article
LimaCharlie’s full blog post covers the operational detection detail this post intentionally leaves for the source:
- Office 365 adapter workflow for bringing mailbox telemetry into a central analysis view
- Step-by-step detection logic for New-InboxRule and related mailbox operations
- Example response handling that tags suspicious activity for analyst review
- How to structure custom metadata so mailbox alerts support triage and investigation
👉 Read LimaCharlie’s analysis of multi-source telemetry for business email compromise →
Business email compromise telemetry: what detection teams need now?
Explore further
01/08/2026 10:53 pm
Mailbox telemetry is now an identity control problem, not just a logging problem. Once an attacker can change inbox rules or forwarding paths, the mailbox becomes a persistence layer. That means identity and mail administrators need shared visibility into account activity, not separate views that leave gaps between authentication, message handling, and response. The practical conclusion is that BEC defence starts with identity-adjacent telemetry design.
A question worth separating out:
Q: What should teams do when mailbox manipulation is detected?
A: They should contain the account, review recent sign-ins, inspect forwarding and inbox rules, and preserve mailbox activity for investigation before returning access. If the account supports finance, payroll, or vendor communications, the response should also include fraud checks on recent outbound requests and payment changes.
👉 Read our full editorial: Multi-source telemetry sharpens business email compromise detection
