AiTM - Fraudulent Invoice Generation (T1566)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•3•0•9

This rule detects potential business email compromise (BEC) activity where a compromised mailbox is used to send internal phishing emails or fraudulent invoices to financial departments. It identifies emails sent internally with subjects containing keywords like 'Invoice', 'Payment', 'Wire Transfer', or 'Updated Account', and correlates them with email sending events from cloud applications.