T1657 — Financial Theft

# T1657 - Financial Theft

## SOC Recommendation
Investigate Financial Theft activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
let lookback = 1h;
let paymentKeywords = dynamic(["wire transfer", "urgent payment", "bank details", "invoice update", "swift", "iban", "payment today", "change of bank", "new account details", "remittance"]);
let riskySenderTerms = dynamic(["accounts", "payable", "finance", "invoice", "payment", "billing"]);
EmailEvents
| where TimeGenerated >= ago(lookback)
| where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)
| where SenderFromDomain !endswith ".internal"
| extend SenderLocalPart = tolower(tostring(split(SenderFromAddress, "@")[0]))
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    MessageCount = count(),
    Recipients = make_set(RecipientEmailAddress, 50),
    Subjects = make_set(Subject, 20),
    NetworkMessageIds = make_set(NetworkMessageId, 20),
    RecipientCount = dcount(RecipientEmailAddress)
    by SenderFromAddress, SenderFromDomain, SenderLocalPart, bin(TimeGenerated, 30m)
| where MessageCount >= 3 or RecipientCount >= 3 or SenderLocalPart has_any (riskySenderTerms)
| project TimeGenerated, FirstSeen, LastSeen, SenderFromAddress, SenderFromDomain, MessageCount, RecipientCount, Recipients, Subjects, NetworkMessageIds
| extend timestamp = LastSeen,
         AccountCustomEntity = SenderFromAddress
| order by MessageCount desc, RecipientCount desc
```
```kql
let lookback = 1h;
let paymentKeywords = dynamic(["wire transfer", "urgent payment", "bank details", "swift", "iban", "payment today", "invoice update", "change of bank", "new account details"]);
let suspiciousEmails =
    EmailEvents
    | where TimeGenerated >= ago(lookback)
    | where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)
    | where SenderFromDomain !endswith ".internal"
    | project NetworkMessageId, EmailTime = TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject;
let suspiciousForwarding =
    OfficeActivity
    | where TimeGenerated >= ago(lookback)
    | where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
    | where Parameters has_any ("ForwardTo", "ForwardingSmtpAddress", "RedirectTo", "DeliverToMailboxAndForward")
    | project RuleTime = TimeGenerated, UserId = tolower(UserId), Operation, Parameters;
suspiciousEmails
| extend RecipientKey = tolower(RecipientEmailAddress)
| join kind=inner suspiciousForwarding on $left.RecipientKey == $right.UserId
| where RuleTime between (EmailTime - 60m .. EmailTime + 60m)
| project
    TimeGenerated = coalesce(RuleTime, EmailTime),
    EmailTime,
    RuleTime,
    SenderFromAddress,
    SenderFromDomain,
    RecipientEmailAddress,
    Subject,
    Operation,
    Parameters,
    NetworkMessageId
| extend timestamp = TimeGenerated,
         AccountCustomEntity = RecipientEmailAddress
| order by TimeGenerated desc
```
```kql
Alerts_darkweb_ransomware
| where Service == "darkweb_ransomware"
| extend MappedSeverity = Severity
```

## Escalation Criteria
- Financial Theft activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1657.json
• /api/recommendations/T1657.json
• /api/d3fend/T1657.json
• /api/mappings/T1657.json
• /api/confluence/T1657.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1657.json

Response:

{
  "technique_id": "T1657",
  "name": "Financial Theft",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Impact"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Office Suite",
    "SaaS",
    "Windows"
  ],
  "summary": "Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, \"pig butchering,\" bank hacking, and exploiting cryptocurrency networks...",
  "soc_recommendation": "Investigate Financial Theft activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NTA",
      "name": "Network Traffic Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Network Traffic Analysis indicators relevant to this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.",
      "Check whether activity aligns with a planned change or approved business process.",
      "Identify all affected users/devices/resources over the prior 24 hours.",
      "Determine whether this is isolated or part of a broader campaign.",
      "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.",
      "Elevate severity if privileged identities, critical systems, or repeated activity is observed.",
      "Capture all evidence (query results, entities, timeline) in the incident record.",
      "Route to the appropriate response playbook and customer escalation path."
    ],
    "generic": [
      "Confirm whether the observed financial theft activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Payment Detail Change Request Surge\" -- Detects bursts of payment-detail-change or urgent-payment messages from an external sender. IM-016 remains the BEC rule with inbox-forwarding correlation."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain impacted identities/endpoints/sessions based on obse",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Contain impacted identities/endpoints/sessions based on observed behavior."
    },
    {
      "name": "Block malicious indicators (IP, URL, domain, hash) where ava",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Block malicious indicators (IP, URL, domain, hash) where available."
    },
    {
      "name": "Complete blast radius analysis across related logs and entit",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Complete blast radius analysis across related logs and entities."
    },
    {
      "name": "Notify stakeholders according to incident priority and custo",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Notify stakeholders according to incident priority and customer SLA."
    },
    {
      "name": "Remove persistence or unauthorized access paths identified d",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remove persistence or unauthorized access paths identified during investigation."
    },
    {
      "name": "Capture lessons learned and update rule tuning/watchlists.",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-IM-011 — Payment Detail Change Request Surge",
        "description": "Detects bursts of payment-detail-change or urgent-payment messages from an external sender. IM-016 remains the BEC rule with inbox-forwarding correlation. (Source: Bell Integration baseline detection library.)",
        "query": "let lookback = 1h;\nlet paymentKeywords = dynamic([\"wire transfer\", \"urgent payment\", \"bank details\", \"invoice update\", \"swift\", \"iban\", \"payment today\", \"change of bank\", \"new account details\", \"remittance\"]);\nlet riskySenderTerms = dynamic([\"accounts\", \"payable\", \"finance\", \"invoice\", \"payment\", \"billing\"]);\nEmailEvents\n| where TimeGenerated >= ago(lookback)\n| where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)\n| where SenderFromDomain !endswith \".internal\"\n| extend SenderLocalPart = tolower(tostring(split(SenderFromAddress, \"@\")[0]))\n| summarize\n    FirstSeen = min(TimeGenerated),\n    LastSeen = max(TimeGenerated),\n    MessageCount = count(),\n    Recipients = make_set(RecipientEmailAddress, 50),\n    Subjects = make_set(Subject, 20),\n    NetworkMessageIds = make_set(NetworkMessageId, 20),\n    RecipientCount = dcount(RecipientEmailAddress)\n    by SenderFromAddress, SenderFromDomain, SenderLocalPart, bin(TimeGenerated, 30m)\n| where MessageCount >= 3 or RecipientCount >= 3 or SenderLocalPart has_any (riskySenderTerms)\n| project TimeGenerated, FirstSeen, LastSeen, SenderFromAddress, SenderFromDomain, MessageCount, RecipientCount, Recipients, Subjects, NetworkMessageIds\n| extend timestamp = LastSeen,\n         AccountCustomEntity = SenderFromAddress\n| order by MessageCount desc, RecipientCount desc"
      },
      {
        "name": "GEN-IM-016 — Financial Theft - BEC With Forwarding Rule",
        "description": "Correlates payment-lure email with suspicious forwarding/redirect rules, keeping this distinct from IM-011's payment-detail-change surge detector. (Source: Bell Integration baseline detection library.)",
        "query": "let lookback = 1h;\nlet paymentKeywords = dynamic([\"wire transfer\", \"urgent payment\", \"bank details\", \"swift\", \"iban\", \"payment today\", \"invoice update\", \"change of bank\", \"new account details\"]);\nlet suspiciousEmails =\n    EmailEvents\n    | where TimeGenerated >= ago(lookback)\n    | where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)\n    | where SenderFromDomain !endswith \".internal\"\n    | project NetworkMessageId, EmailTime = TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject;\nlet suspiciousForwarding =\n    OfficeActivity\n    | where TimeGenerated >= ago(lookback)\n    | where Operation in~ (\"New-InboxRule\", \"Set-InboxRule\", \"Set-Mailbox\")\n    | where Parameters has_any (\"ForwardTo\", \"ForwardingSmtpAddress\", \"RedirectTo\", \"DeliverToMailboxAndForward\")\n    | project RuleTime = TimeGenerated, UserId = tolower(UserId), Operation, Parameters;\nsuspiciousEmails\n| extend RecipientKey = tolower(RecipientEmailAddress)\n| join kind=inner suspiciousForwarding on $left.RecipientKey == $right.UserId\n| where RuleTime between (EmailTime - 60m .. EmailTime + 60m)\n| project\n    TimeGenerated = coalesce(RuleTime, EmailTime),\n    EmailTime,\n    RuleTime,\n    SenderFromAddress,\n    SenderFromDomain,\n    RecipientEmailAddress,\n    Subject,\n    Operation,\n    Parameters,\n    NetworkMessageId\n| extend timestamp = TimeGenerated,\n         AccountCustomEntity = RecipientEmailAddress\n| order by TimeGenerated desc"
      },
      {
        "name": "6deaf986-a25b-47b4-afbe-667901aa313b — Cyble Vision Alerts Darkweb Ransomware Leak",
        "description": "A ransomware threat actor has posted victim data on the dark web. This alert includes leaked documents, threat actor name, victim organization, timestamps, and extracted text content for SOC triage.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "Alerts_darkweb_ransomware\n| where Service == \"darkweb_ransomware\"\n| extend MappedSeverity = Severity"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "5f0234fd-7f21-42af-8391-511d5fd11d5c — AWS S3 Bucket Enumeration or Brute Force",
        "description": "(KUERY) Identifies a high number of failed S3 operations against a single bucket from a single source address within a short timeframe. This activity can indicate attempts to collect bucket objects or cause an increase in billing to an account via internal \"AccessDenied\" errors. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "data_stream.dataset: \"aws.cloudtrail\" and \n  event.provider : \"s3.amazonaws.com\" and \n  aws.cloudtrail.error_code : \"AccessDenied\" and \n  tls.client.server_name : *"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Financial Theft activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners",
    "Security testing or red-team exercise — Source identity/host matches approved test plan"
  ],
  "confluence": {
    "title": "T1657 - Financial Theft Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}