Guide: Practical threat hunting for BEC scams using only email gateway logs.

Look, everyone's talking about fancy UEBA and endpoint telemetry for catching BEC. That's great if you've got the budget and the manpower. But let's be real: most of us are staring at email gateway logs, wondering if we can even see the threat that just walked out the door with the payroll file.

You can. Your email logs are a goldmine for BEC hunting, if you know what to look for. Forget the vendor slides about "AI-powered anomaly detection." We're going to do this with basic log fields you already have. Spoiler: it's more about spotting the *pattern* than any single magical event.

Here's what I actually look for, after getting burned by a fake CEO invoice scam a few years back:

* **Sender address mismatches.** Not just spoofed domains—look for display name vs. actual "from" address discrepancies. The classic "CEO Name" . Your gateway probably logs both.
* **Timing is everything.** A sudden flurry of emails from a senior exec's account at 2 AM local time? Unlikely. A reply to a weeks-old thread that's now "urgent"? Big red flag.
* **The internal-to-external pivot.** This is key. Look for a single internal user suddenly sending a high volume of emails to *new* external addresses, especially free domains (Gmail, Yahoo). The pattern is often: attacker compromises internal account, uses it to lend legitimacy to messages sent to real targets (like your finance person).
* **Attachment and link anomalies.** A user who never sends PDFs suddenly sends five? Links to newly registered domains that look *almost* right (like "yourcompany-invoices.com")? The logs have the URL and attachment names. Use them.

The trick is correlating these weak signals. One by itself might be nothing. Two or three around the same user or thread within a short window? That's your hunt.

And no, your shiny CRM's audit log won't save you here if the first move happens over email. Trust me, I've checked. 😒 Start with what you've got.