A threat actor impersonates CEO M. Reynolds using m-reynolds-ceo@gmail.com and emails j.whitfield asking for a $47,500 wire transfer to Trident Capital Partners LLC. MailGuard catches it as THREAT-002 and blocks the email. SOAR playbook PB-008 triggers, though it's currently in draft. Meanwhile, Identity flags a suspicious inbox rule on j.whitfield's account that forwards emails with keywords like "invoice", "wire", and "payment" to an external address, suggesting prior account access.
Click each step to expand. Open the linked tool page, walk through what's there, then ask the discussion questions.
Open MailGuard and go to BEC Cases. Find BEC-001. Then go to Threats and open THREAT-002. Show the email: it's from m-reynolds-ceo@gmail.com addressed to j.whitfield, asking for a wire transfer that needs to go out today. Point out what makes it convincing: the sender name matches the CEO, the request has urgency baked in, and it asks to keep it confidential. The only giveaway is the Gmail domain.
Open Identity and go to Protection. Find RISK-011 for j.whitfield. Show the inbox forwarding rule: emails containing "invoice", "wire", "payment", or "transfer" are being silently forwarded to billing@acme-industr1al.com — the same homoglyph domain used in VF-001. This rule was created from IP 203.0.113.99 (unknown external) and wasn't created by j.whitfield. It suggests the attacker already had access to the mailbox before sending the BEC email, possibly doing financial workflow reconnaissance first.
Open SOAR and go to Cases. Find CASE-2024-0218. Then go to Playbooks and open PB-008 BEC Wire Fraud Prevention. Show that it's in draft status, which means it fired but couldn't take automated action. Walk through what the playbook would do if approved: notify the finance team, put a hold on outbound wire transfers, quarantine the email thread, and kick off an identity investigation for j.whitfield. This is a good moment to discuss how an incomplete playbook still creates value by surfacing the case.
Open CASB and go to DLP. Find DLP-002 for j.whitfield: a WeTransfer upload to a destination containing acme-industr1al.com (that's a homoglyph domain, the "1" in "industr1al"). This is a data transfer that happened two hours after j.whitfield received the BEC email. It's possible j.whitfield was responding to the attacker. This connects BEC-001 to the VF-001 vendor fraud scenario and shows how attackers run parallel operations.