kevmap

TechniquesT1657 › AN1365

AN1365 Analytic 1365

Office Suite · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Monitor email and document management systems for fraudulent invoices, impersonation of vendors, or BEC-style payment redirections. Detect abnormal editing of invoice templates, or emails containing known fraud language combined with attachment delivery.</p>
Detects
T1657 Financial Theft
Part of
DET0495 Detection Strategy for Financial Theft

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
m365:unifiedMailSend: Outlook messages with suspicious subject/body terms (e.g., urgent payment, wire transfer) targeting finance teamsDC0038 Application Log Content
m365:officeAnomalous editing of invoice or payment document templatesDC0061 File Modification

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
FraudTermsAdjustable keyword list for email and document fraud detection.