What workarounds did people try for "How to tell if a BEC attack was caught automatically or by a human"?

Community members documented 6 workarounds: 1. relying on IAM suspicious sign-in reports 2. checking outbound anti-spam rules after bulk sends 3. using powershell to audit forwarding rules after user complaints 4. Searching audit logs using PowerShell or Purview for MailItemsAccessed events 5. Manually inspecting inbox rules, hidden rules, and forwarding addresses 6. Checking OAuth app consents under enterprise applications

How to tell if a BEC attack was caught automatically or by a human

Security controls often fail to flag Business Email Compromise cases because attackers lurk silently in mailboxes for weeks without triggering outbound spam alerts. This leaves security teams unable to determine whether automated defenses or manual human review actually caught the breach.

Overview

Last updated Sep 17, 2026

People affected3 accounts across 2 forums

Workarounds found6 items attempted

Community agreement2 total upvotes

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

6 items+ Contribute

Found another way around this?

Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.

1
relying on IAM suspicious sign-in reports
Did this help you?
2
checking outbound anti-spam rules after bulk sends
Did this help you?
3
using powershell to audit forwarding rules after user complaints
Did this help you?
4
Searching audit logs using PowerShell or Purview for MailItemsAccessed events
Did this help you?
5
Manually inspecting inbox rules, hidden rules, and forwarding addresses
Did this help you?
6
Checking OAuth app consents under enterprise applications
Did this help you?

Tried another approach not listed above?+ Share your workaround ↑

In their words

Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.

r/ITManagers2 people · September 2026

“I caught one last year where someone was sitting in a mailbox for like six weeks just reading everything and setting up rules to hide replies from vendors. no outbound spam or anything just silently gathering contract details”source ↗

DoubtfulIrving63 · r/ITManagers · 1 upvotes

“We had the dumbest person person get access right after sign in check. Sat there for a week and had access to literal gold mine of stuff.”source ↗

ZobooMaf0o0 · r/ITManagers · 1 upvotes

r/sysadmin1 person · September 2026

“when you've dealt with BEC case, did email auth flagged it, or did it look totally normal and only a human caught it?”source ↗

deepikaau · r/sysadmin

Where this came up

r/ITManagers r/sysadmin cloud security cybersecurity email security incident response IT administration