SQ-FR-01Level 3 · Sequence4 steps in 14 days
Approver under attack
- 4 steps
- 14 days
- Level 3 · Sequence
An impersonation message reaches a person who holds payment approval authority, the person replies, a forwarding rule to an outside account appears on their mailbox, and a payee change is approved, all within 14 days.
Classification
- Risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- ATT&CK tactics
-
- Initial Access
- Execution
- Collection
- Impact
- NIST CSF 2.0 (from its signals)
-
- ID.RA-03
- DE.CM-03
- PR.DS-02
- PR.AA-05
- MITRE ATT&CK (from its signals)
-
- T1684.001
- T1566
- T1114.003
- T1657
The sequence, step by step
SQ-FR-014 stepsPeak: Stage 4 Suspected
Step 01ATT&CK tactic: Initial Access
Impersonation delivered
SE-T-03Receives impersonation attempts
Stage 1Exposed
Step 02ATT&CK tactic: Execution
Replied to sender
SE-B-09Replies to or engages with suspicious senders
Stage 3Exploited
Step 03ATT&CK tactic: Collection
Forwarding rule created
DH-B-06Forwards work email to personal accounts
Stage 4Suspected
Step 04ATT&CK tactic: Impact
Payee change approved
SE-A-02Holds payment approval authority
Stage 4Suspected
Approver under attack, 4 steps inside 14 days: Impersonation delivered (SE-T-03 Receives impersonation attempts, Initial Access, Stage 1 Exposed); then Replied to sender (SE-B-09 Replies to or engages with suspicious senders, Execution, Stage 3 Exploited); then Forwarding rule created (DH-B-06 Forwards work email to personal accounts, Collection, Stage 4 Suspected); then Payee change approved (SE-A-02 Holds payment approval authority, Impact, Stage 4 Suspected). It leads to HB-05 BEC & payment fraud.
A completed sequence is evidence that its steps happened in order inside 14 days: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.
The definition, in detail
Definition
The impersonation places the approver at Stage 1, the reply moves them to Stage 3, and the forwarding rule completes the sequence at Stage 4 before the payment goes out.
Example
A controller answered a quick question from a spoofed CEO address, a rule quietly forwarded her mail to an outside address, and ten days later she approved new bank details for a long-standing supplier.
The steps
4 steps, in order.
-
Impersonation delivered
-
Replied to sender
-
Forwarding rule created
-
Payee change approved
How it is measured
- Steps
- 4
- Window
- 14 days
- Sources
- Email security, Finance & payments
- Breach scenario
- BEC & payment fraud
How it is used
Programs watch the 4 steps in order inside 14 days; a completed run moves the person to Stage 4 Suspected and points at BEC & payment fraud.
A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.
Continue exploring
"Approver under attack" (SQ-FR-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-fr-01-approver-under-attack
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.