Intent-based approach to detect email account compromise Abhishek Singh & Fahim Abbasi (Cisco)

Author: Virus Bulletin - Bewertung: 0x - Views:4

Presented at the VB2023 conference in London, 4 - 6 October 2023. ↓ Slides: https://www.virusbulletin.com/uploads/pdf/conference/vb2023/slides/Slides-Intent-based-approach-to-detect-email-account-compromise.pdf ↓ Paper: https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Intent-based-approach-to-detect-email-account-compromise.pdf → Details: https://www.virusbulletin.com/conference/vb2023/abstracts/intent-based-approach-detect-email-account-compromise/ ✪ PRESENTED BY ✪ • Fahim Abbasi (Cisco) ✪ ABSTRACT ✪ In 2021 the IC3 received 19,954 complaints about BEC/EAC scams, which resulted in a loss of $2.4 billion, making it the number one threat we face today. Email account compromise is a sophisticated category of BEC scam in which the threat actor sends phishing/scam emails from a compromised account, which can result in a significant loss to the company. Since the email account is compromised, algorithms that use feature sets such as DMARC check, SPF check, the difference between from and reply-to, checking if the email is sent from a free email address, look-alike domains, spoofed domains, etc., to detect malicious emails will be bypassed. In the first part of this presentation we will dive into the details of an intent-based approach to detect email account compromise. The design isolates suspicious emails on east-west and outbound traffic. As per the threat actor's intent, suspicious emails are separated based on keywords derived from n-gram analysis of the body and the subject of emails. Once the suspicious emails have been isolated, the past 90 days' record of the sender is extracted. Features that map to the sender's behaviour from the past 90-day historical record and the suspicious email are extracted. These features are correlated to detect email account compromise. In the second part of the presentation we will share the results of the intent-based approach on the production traffic. We will conclude by comparing the intent-based approach with other approaches to detect email account compromise.