Topic starter
01/08/2026 10:43 pm
TL;DR: Multi-source telemetry gives security teams the visibility needed to detect business email compromise patterns such as mailbox rule manipulation and email forwarding abuse, according to LimaCharlie. The real lesson is that detection quality depends on consolidating identity and mail activity into a response-ready view, not on collecting more logs alone.
Editorial analysis by NHI Mgmt Group, based on content published by LimaCharlie: “Multi-source telemetry: finding business email compromise”.
Key questions
Q: What should security teams do first when inbox rules start changing unexpectedly?
A: Start by validating whether the rule change is a normal user action or part of account compromise.
Q: Why do malicious mail rules increase the impact of business email compromise?
A: Malicious mail rules matter because they let attackers automate stealth, exfiltration, and persistence after they get into a mailbox.
Q: What are the signs that email telemetry is not good enough for BEC detection?
A: Warning signs include frequent false positives, alerts that cannot be tied to a person or device, and mailbox events that analysts cannot connect to business context.
Practitioner guidance
- Detect mailbox rule creation and forwarding changes Build alerts around New-InboxRule, forwarding updates, and related mailbox operations in Microsoft 365 or equivalent mail systems.
- Correlate email and identity telemetry Join mailbox events with identity, device, and cloud context so analysts can see who made the change, from where, and what happened immediately before and after it.
- Tag detections to a shared adversary technique Map mailbox manipulation alerts to a common ATT&CK technique reference so SOC, IAM, and fraud teams use consistent triage language.
Bottom line: Business email compromise often hides inside ordinary mailbox operations, which makes rule changes and forwarding abuse more important than single-event login alerts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:53 pm
Multi-source telemetry is now a governance requirement for BEC detection: isolated mailbox logs rarely provide enough context to distinguish normal rule changes from compromise. Correlating identity, mail, and endpoint activity turns a low-signal event into a usable security signal. For practitioners, the governance question is whether detection logic reflects the real attack path rather than a single data source.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should SOC and IAM teams share responsibility for mailbox abuse?
A: SOC should triage the alert and contain the suspicious activity, while IAM should verify whether the account, session, or mailbox control state has been altered in ways that create future abuse. The best operating model treats mailbox manipulation as an identity event with fraud consequences, not as a single-team problem.
👉 Read our full editorial: Multi-source telemetry sharpens business email compromise detection