Detecting Business Email Compromise
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors,
5,195,192 AI resources indexedWorking toward the world’s largest AI resource index.
Reusable instructions for compatible AI agents.
Field counts come from the latest full-catalog snapshot. A resource can belong to several fields and platforms.
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors,
Offensive email security assessment covering SMTP open relay, SPF/DKIM/DMARC bypass, email header injection, and email-based attack vectors during authorized penetration tests.
Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom)
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17),
Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities,
Deploys canary files, honeypot shares, and decoy systems to detect ransomware activity at the earliest possible
Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout
Performs entitlement review and access certification campaigns using SailPoint IdentityIQ including manager
Implement Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows
Implement automated user provisioning and deprovisioning using SCIM 2.0 protocol with Okta as the identity provider.
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise,
Try a broader search or clear some filters.
Platform labels describe intended use. Read each resource's author credits, requirements and available access methods.