Skip to main content
Tier One
High

Executive impersonation email requesting an urgent wire transfer

A-1059

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
Email Gateway
Detection rule
EGW-BEC-DISPLAYNAME-008
Affected user
p.osei
Affected host
WKS-FINANCE-14
Source IP
—
First seen
2026-07-24T16:20:00Z

Why this fired, in plain English

An outside email used an executive's name in the 'From' display, which is a common way to trick staff into paying fake invoices.

Suggested playbook

Phishing report triage

  1. 1. Pull the message headers. Check SPF, DKIM and DMARC results.
  2. 2. Compare the sending domain to the real domain character by character (rn vs m, l vs I, 0 vs o).
  3. 3. Check the reply-to address — attackers often differ it from the From address.
  4. 4. Run WHOIS on any linked domain. Domains under 30 days old are a strong signal.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T16:18:41Z src="email_gateway" event=message_delivered from="rafi.klein.exec@gmail.example" display_name="Rafi Klein" to="p.osei@northwind-mfg.example" subject="Confidential – need this wire out before 5" spf=pass dkim=pass dmarc=pass

    Authentication passes because the attacker really does own that free-mail account. Passing SPF does not mean the sender is trustworthy.

  2. Guided hint: this line matters

    ts=2026-07-24T16:18:41Z src="email_gateway" event=header_analysis reply_to="accounts.klein@protonmail.example" first_seen_sender=true internal_lookalike="r.klein@northwind-mfg.example"

    The reply-to is a different address again, so any answer goes to the attacker.

  3. Guided hint: this line matters

    ts=2026-07-24T16:19:20Z src="email_gateway" event=body_extract snippet="I am in a board meeting. Wire USD 48,750 to the new supplier account today, details attached. Do not call, email only."

    Urgency, secrecy and a block on verifying by phone are the three classic BEC pressure tactics.

Related events

The order things happened in.

  1. 16:18Z

    Impersonation email delivered to the Controller

  2. 16:20Z

    Display-name rule fires

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 3 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.