Attack scenario
Business Email Compromise and mailbox takeover
An adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
Why this scenario matters
BEC often does not require malware. The adversary uses a stolen session or account, mailbox rules, communication history, and social engineering to make messages appear trustworthy.
Effective protection must connect email, identity, session, MFA, domain, and anomalous-user-behavior controls.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Credential Access
- Defense Impairment
- Impact
- Initial Access
- Persistence
- Privilege Escalation
- Reconnaissance
- Stealth
Relevant ATT&CK techniques
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.
Cloud Security
Network Security
Identity and Access Mgmt
- ABACTechnology
- IAM platformsTechnology
- Identity GovernanceTechnology
- Identity LifecycleTechnology
- IGATechnology
- JEATechnology
- JITTechnology
- MFATechnology
- PAMTechnology
- PBACTechnology
- PIMTechnology
- Proximity VerificationTechnology
- RBACTechnology
- ReBACTechnology
- Risk Based AuthenticationTechnology
- SCIMTechnology
- SSOTechnology