T1657 — Financial Theft

Tactic: Impact · Platforms: Linux, macOS, Office Suite, SaaS, Windows

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign…

Sigma detection rules (5)

title: T1657 Financial Theft
id: 9c94301a-a0c6-4e07-a17b-66cb11595f5b
description: 'Detects PowerShell/Exchange mailbox-permission cmdlets (Add-MailboxPermission, Add-RecipientPermission, New-InboxRule, Set-Mailbox) combined with SendAs/SendOnBehalf/ForwardingSmtpAddress/FullAccess arguments, commonly abused in business email compromise (BEC) to enable financial theft. NOTE: financial theft itself (fraudulent wire transfers, social engineering) is a business-process outcome not directly observable via Windows Sysmon/Security telemetry; this rule targets the BEC mailbox-abuse precursor as the closest defensible host-observable proxy, not theft itself. Tune using: FinanceAppList, HighRiskAccounts.'
references:
  - https://attack.mitre.org/techniques/T1657
author: Shahrukh Khan
date: 2026-06-11
license: MIT
tags:
  - attack.impact
  - attack.t1657

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_shell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_mailbox_abuse:
    CommandLine|contains:
      - 'Add-MailboxPermission'
      - 'Add-RecipientPermission'
      - 'New-InboxRule'
      - 'Set-Mailbox'
  selection_forward_or_impersonate:
    CommandLine|contains:
      - 'ForwardingSmtpAddress'
      - 'SendAs'
      - 'SendOnBehalf'
      - 'FullAccess'

  condition: selection_shell and selection_mailbox_abuse and selection_forward_or_impersonate

falsepositives:
  - Legitimate finance-application automation add-ins; legitimate Exchange/M365 administrators granting delegate mailbox access or configuring shared-mailbox forwarding. This proxy detects BEC-enabling mailbox manipulation, not confirmed fraud — real coverage needs banking/ERP application-layer monitoring in addition to this rule.

level: high

title: T1657 Financial Theft
id: 5572bab2-77c9-448b-9fb1-350e8d757812
description: 'T1657 Financial Theft (extortion, BEC/fraud, "pig butchering", bank hacking, cryptocurrency-network exploitation) is fundamentally a business-outcome/social-engineering technique -- the actual deception, negotiation, and fund-transfer approval happen over email/communications and at a financial institution, none of which is visible in Linux auditd/syscall telemetry. Merely running a cryptocurrency wallet CLI or dumping a database with finance-sounding table names (the original logic) is routine legitimate treasury/finance/backup activity and is not a meaningful signal on its own. As the closest defensible Linux-observable proxy, this rule narrows to the one OS-level action plausibly tied to the "technical theft" sub-behavior: a file-copy/transfer utility (not the wallet application itself) being invoked with a cryptocurrency wallet key/data file as an argument, consistent with staging or exfiltrating wallet secrets. Tune using: KnownFinanceIPs.'
references:
  - https://attack.mitre.org/techniques/T1657
author: Shahrukh Khan
date: 2026-06-24
license: MIT
tags:
  - attack.impact
  - attack.t1657

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_wallet_file_transfer:
    type: EXECVE
    a0|endswith:
      - '/cp'
      - '/tar'
      - '/scp'
      - '/rsync'
      - '/curl'
      - '/wget'
    a1|contains:
      - 'wallet.dat'
      - 'wallet.key'
      - '.wallet'
      - 'keystore'

  condition: selection_wallet_file_transfer

falsepositives:
  - Legitimate backup jobs or wallet-migration procedures copying wallet/keystore files; scope KnownFinanceIPs/paths to the approved treasury/payment endpoint hosts and backup destinations.
  - This rule cannot detect the BEC/social-engineering/extortion mechanisms that make up most of T1657 -- those require email-gateway and financial-transaction monitoring, not host telemetry.

level: medium

title: T1657 Financial Theft
id: 625f525f-5c35-4742-aeba-dfffe75ed8ae
description: 'Detection Strategy for Financial Theft. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredApps.'
references:
  - https://attack.mitre.org/techniques/T1657
author: Shahrukh Khan
date: 2026-06-04
license: MIT
tags:
  - attack.impact
  - attack.t1657

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/python3'
      - '/osascript'
    CommandLine|contains:
      - 'clipboard'
      - 'pbpaste'

  condition: selection

falsepositives:
  - Legitimate clipboard manager utilities and automation scripts that read clipboard content for benign productivity purposes; actual cryptocurrency address swapping happens in memory and is not distinguishable from this telemetry alone.

level: medium

title: T1657 Financial Theft
id: 49febd8b-e4c3-4ff1-8388-0a53cc4c1dac
description: 'Detection Strategy for Financial Theft. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: TransactionThreshold.'
references:
  - https://attack.mitre.org/techniques/T1657
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.impact
  - attack.t1657

logsource:
  product: saas
  service: finance

detection:
  selection_payee:
    event_type: 'payee_added'
  selection_payment:
    event_type: 'payment_created'

  condition: 1 of selection_*

falsepositives:
  - Legitimate onboarding of a new vendor or contractor payee followed by a normal scheduled invoice payment.

level: high

title: T1657 Financial Theft
id: 660cb27f-c6d7-48ee-b726-9cd6207401c6
description: 'Detection Strategy for Financial Theft. Financial theft primary sub-behaviors (fraudulent wire transfers, BEC social engineering, ransom payment negotiation) occur inside business applications, email, and off-host financial systems, and produce no OS-level auditd signal - host file events carry no content and cannot confirm financial relevance. This rule does NOT attempt to detect fraud/BEC directly; it implements the closest defensible host-observable proxy for the one sub-behavior with a Linux filesystem footprint - ransomware-style extortion - by watching for creation of files bearing common ransomware-encryption extensions. Genuine financial-theft detection requires application/financial-system audit logs or SIEM correlation, not this rule alone. Tune using: FraudTerms, RansomExtensionList.'
references:
  - https://attack.mitre.org/techniques/T1657
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.impact
  - attack.t1657

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|endswith:
      - '.encrypted'
      - '.locked'
      - '.crypt'
      - '.enc'
      - '.ransom'

  condition: selection

falsepositives:
  - Legitimate encryption, compression, or backup tooling that produces files with these same extensions; this rule only proxies the ransomware-extortion sub-behavior of Financial Theft and cannot detect fraudulent transfers, BEC, or ransom-payment activity, none of which have an OS-level trace.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1657 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan