detecting-business-email-compromise
From the author
Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data,
Install
npx skills add 26zl/cybersec-toolkit --skill detecting-business-email-compromise -a claude-code
Installs to .claude/skills/detecting-business-email-compromise/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- BEC ResponseWYRE-AI/msp-claude-pluginsBusiness Email Compromise detection and first response: the signals that reveal it in CIPP/M365 audit logs, mailbox and forwarding rules, and connected email security vendor alerts; the order-dependent response sequence (session revocation, forwarding-rule audit, mailbox rule and delegate cleanup, password reset, MFA re-enrollment, lateral-spread check, recipient notification); and what a defensible incident timeline must capture for insurance or bank-fraud claims.Security★ 50
- identity-compromisegensecaihq/Wazuh-AutopilotInvestigate suspected account compromise — brute force followed by success, impossible travel, privilege escalation and lateral movement across Linux and Windows; use when a user account appears in suspicious authentication activity.Finance★ 60
- Abnormal Security ThreatsWYRE-AI/msp-claude-pluginsAbnormal Security threat detection: threat types (BEC, phishing, malware, socially-engineered attacks, spam, graymail, credential theft), attack vectors, severity assessment, remediation actions, and investigation workflows.Security★ 50
- detecting-email-account-compromise26zl/cybersec-toolkitDetect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.Productivity★ 84
- uk-business-englishjezweb/claude-skillsBritish business English writing style for professional communications — polished, understated, EN-GB spelling (colour, organise, centre). Use whenever the user is writing for a British audience: emails, chat messages, proposals, client communications, blog posts, web copy, or any business writing. Apply to drafting, editing, and tone-checking professional text.Writing★ 1.1K
- collecting-indicators-of-compromise26zl/cybersec-toolkitSystematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.Security★ 84
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in