Topic starter
01/08/2026 10:43 pm
TL;DR: Business email compromise is easier to spot when mailbox rules, forwarding abuse, identity signals, and device telemetry are viewed together, LimaCharlie says. Identity and mailbox operations need to be analysed in context so analysts can confirm fraud faster and respond with consistent triage.
Editorial analysis by NHI Mgmt Group, based on content published by LimaCharlie: “Multi-source telemetry: finding business email compromise”.
Key questions
Q: Why do malicious mail rules increase the impact of business email compromise?
A: Malicious mail rules matter because they let attackers automate stealth, exfiltration, and persistence after they get into a mailbox.
Q: What are the signs that email telemetry is not good enough for BEC detection?
A: Warning signs include frequent false positives, alerts that cannot be tied to a person or device, and mailbox events that analysts cannot connect to business context.
Q: What should security teams do first when inbox rules start changing unexpectedly?
A: Start by validating whether the rule change is a normal user action or part of account compromise.
Practitioner guidance
- Detect mailbox rule creation and forwarding changes Build alerts around New-InboxRule, forwarding updates, and related mailbox operations in Microsoft 365 or equivalent mail systems.
- Correlate email and identity telemetry Join mailbox events with identity, device, and cloud context so analysts can see who made the change, from where, and what happened immediately before and after it.
- Tag detections to a shared adversary technique Map mailbox manipulation alerts to a common ATT&CK technique reference so SOC, IAM, and fraud teams use consistent triage language.
Bottom line: Business email compromise often hides inside ordinary mailbox operations, which makes rule changes and forwarding abuse more important than single-event login alerts.
Glossary terms: Business email compromise, Inbox Rule Abuse, Multi-source Telemetry, Mailbox Control Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 hour ago by NHI Mgmt Group
01/08/2026 10:53 pm
Multi-source telemetry is now a governance requirement for BEC detection: isolated mailbox logs rarely provide enough context to distinguish normal rule changes from compromise. Correlating identity, mail, and endpoint activity turns a low-signal event into a usable security signal. For practitioners, the governance question is whether detection logic reflects the real attack path rather than a single data source.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should SOC and IAM teams share responsibility for mailbox abuse?
A: SOC should triage the alert and contain the suspicious activity, while IAM should verify whether the account, session, or mailbox control state has been altered in ways that create future abuse. The best operating model treats mailbox manipulation as an identity event with fraud consequences, not as a single-team problem.
👉 Read our full editorial: Multi-source telemetry sharpens business email compromise detection