BEC Defense: Detecting Underground Tactics, Account Compromise, and Cash-Out Networks

---
title: PowerShell Exchange Online Mailbox Rule Manipulation
id: 8a4b2c91-1d3e-4f5a-9b6c-7d8e9f0a1b2c
status: experimental
description: Detects PowerShell commands used to create or modify Inbox rules, a common BEC tactic to hide replies and fraudulent emails.
references:
  - https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1114.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_pwsh:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmdlet:
    CommandLine|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
      - 'Enable-InboxRule'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative mailbox management
level: high
---
title: Suspicious Mailbox Export via PowerShell
id: 9c5d3e02-2e4f-5g6a-0c7d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to export mailbox data using PowerShell, indicative of the "financial research" phase where attackers harvest invoice history.
references:
  - https://attack.mitre.org/techniques/T1114/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1114
logsource:
  category: process_creation
  product: windows
detection:
  selection_pwsh:
    Image|endswith: '\powershell.exe'
  selection_export:
    CommandLine|contains:
      - 'New-MailboxExportRequest'
      - 'Search-Mailbox'
      - 'Export-Mailbox'
  selection_target:
    CommandLine|contains:
      - '-TargetFolder'
      - '-TargetRootFolder'
  condition: all of selection_*
falsepositives:
  - Legitimate legal hold or backup exports
level: medium

// Hunt for BEC precursors: Rule creation and Message Export
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("New-InboxRule", "Set-InboxRule", "Update-InboxRule", "New-MailboxExportRequest", "Search-Mailbox")
| extend Parameters = iff(isnotempty(Parameters), tostring(Parameters), "")
| where Parameters contains "DeleteMessage" 
   or Parameters contains "MoveToFolder" 
   or Parameters contains "ForwardTo"
   or Operation contains "Export"
| project TimeGenerated, ClientIP, UserId, Operation, Parameters, RecordType
| extend Timestamp = TimeGenerated, Account = UserId, IP = ClientIP
| order by TimeGenerated desc

-- Hunt for PowerShell processes performing BEC-related activities
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'powershell.exe'
  AND (
    CommandLine =~ 'InboxRule' OR
    CommandLine =~ 'MailboxExport' OR
    CommandLine =~ 'Set-CASMailbox' OR
    CommandLine =~ 'Connect-ExchangeOnline'
  )

<#
.SYNOPSIS
    Audit and Disable Suspicious Inbox Rules for a User.
.DESCRIPTION
    Connects to Exchange Online to list all rules and disables any that forward emails
    or delete messages (common BEC persistence mechanisms).
#>

param(
    [Parameter(Mandatory=$true)]
    [string]$UserPrincipalName
)

# Ensure Exchange Online module is installed and connected
# Connect-ExchangeOnline -UserPrincipalName $AdminCredential

Write-Host "[+] Auditing Inbox Rules for: $UserPrincipalName" -ForegroundColor Cyan

try {
    $rules = Get-InboxRule -Mailbox $UserPrincipalName -ErrorAction Stop

    if ($rules) {
        foreach ($rule in $rules) {
            $isSuspicious = $false
            $reasons = @()

            # Check for forwarding to external domains
            if ($rule.ForwardTo -or $rule.RedirectTo) {
                $isSuspicious = $true
                $reasons += "External Forwarding"
            }

            # Check for deletion of messages (hiding replies)
            if ($rule.DeleteMessage -eq $true) {
                $isSuspicious = $true
                $reasons += "Message Deletion"
            }

            # Check for moving to specific non-default folders
            if ($rule.MoveToFolder -and $rule.MoveToFolder -notmatch "Inbox|Deleted Items|Sent Items") {
                $isSuspicious = $true
                $reasons += "Suspicious Folder Move"
            }

            if ($isSuspicious) {
                Write-Host "[!] SUSPICIOUS RULE FOUND: $($rule.Name)" -ForegroundColor Red
                Write-Host "    - Reasons: $($reasons -join ', ')"
                
                # Disable the rule immediately
                Disable-InboxRule -Identity $rule.Identity -Mailbox $UserPrincipalName -Confirm:$false
                Write-Host "    - Action: Rule Disabled." -ForegroundColor Yellow
            }
            else {
                Write-Host "[-] Rule deemed benign: $($rule.Name)" -ForegroundColor Green
            }
        }
    }
    else {
        Write-Host "[Info] No Inbox Rules found for user." -ForegroundColor Gray
    }
}
catch {
    Write-Error "Failed to retrieve rules. Ensure you are connected to Exchange Online and have sufficient permissions."
    Write-Error $_.Exception.Message
}