# T1657 - Financial Theft

## SOC Recommendation
Investigate Financial Theft activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
let lookback = 1h;
let paymentKeywords = dynamic(["wire transfer", "urgent payment", "bank details", "invoice update", "swift", "iban", "payment today", "change of bank", "new account details", "remittance"]);
let riskySenderTerms = dynamic(["accounts", "payable", "finance", "invoice", "payment", "billing"]);
EmailEvents
| where TimeGenerated >= ago(lookback)
| where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)
| where SenderFromDomain !endswith ".internal"
| extend SenderLocalPart = tolower(tostring(split(SenderFromAddress, "@")[0]))
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    MessageCount = count(),
    Recipients = make_set(RecipientEmailAddress, 50),
    Subjects = make_set(Subject, 20),
    NetworkMessageIds = make_set(NetworkMessageId, 20),
    RecipientCount = dcount(RecipientEmailAddress)
    by SenderFromAddress, SenderFromDomain, SenderLocalPart, bin(TimeGenerated, 30m)
| where MessageCount >= 3 or RecipientCount >= 3 or SenderLocalPart has_any (riskySenderTerms)
| project TimeGenerated, FirstSeen, LastSeen, SenderFromAddress, SenderFromDomain, MessageCount, RecipientCount, Recipients, Subjects, NetworkMessageIds
| extend timestamp = LastSeen,
         AccountCustomEntity = SenderFromAddress
| order by MessageCount desc, RecipientCount desc
```
```kql
let lookback = 1h;
let paymentKeywords = dynamic(["wire transfer", "urgent payment", "bank details", "swift", "iban", "payment today", "invoice update", "change of bank", "new account details"]);
let suspiciousEmails =
    EmailEvents
    | where TimeGenerated >= ago(lookback)
    | where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)
    | where SenderFromDomain !endswith ".internal"
    | project NetworkMessageId, EmailTime = TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject;
let suspiciousForwarding =
    OfficeActivity
    | where TimeGenerated >= ago(lookback)
    | where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
    | where Parameters has_any ("ForwardTo", "ForwardingSmtpAddress", "RedirectTo", "DeliverToMailboxAndForward")
    | project RuleTime = TimeGenerated, UserId = tolower(UserId), Operation, Parameters;
suspiciousEmails
| extend RecipientKey = tolower(RecipientEmailAddress)
| join kind=inner suspiciousForwarding on $left.RecipientKey == $right.UserId
| where RuleTime between (EmailTime - 60m .. EmailTime + 60m)
| project
    TimeGenerated = coalesce(RuleTime, EmailTime),
    EmailTime,
    RuleTime,
    SenderFromAddress,
    SenderFromDomain,
    RecipientEmailAddress,
    Subject,
    Operation,
    Parameters,
    NetworkMessageId
| extend timestamp = TimeGenerated,
         AccountCustomEntity = RecipientEmailAddress
| order by TimeGenerated desc
```
```kql
Alerts_darkweb_ransomware
| where Service == "darkweb_ransomware"
| extend MappedSeverity = Severity
```

## Escalation Criteria
- Financial Theft activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.