Describing attacks with crime script analysis
The article introduces crime script analysis (CSA) as a narrative-driven technique for describing cyber attacks alongside or as an alternative to TTP-based frameworks like MITRE ATT&CK. Using a business email compromise (BEC) case study, the author demonstrates how AI can industrialize BEC attacks by automating reconnaissance and social engineering message generation. The article identifies specific intervention points across the seven-step BEC crime script where defenders can disrupt attacker workflows.
Detection / Hunteropenrouter
What Happened
The article explains a method called crime script analysis, which describes cyber attacks as step-by-step stories in plain language so that both technical and non-technical people can understand them. The author uses a business email compromise scam as an example, where an attacker impersonates a senior colleague to trick someone into making an urgent payment. The article highlights that AI tools can now automate the time-consuming research and message-writing steps of these scams, making it profitable to target many small organizations rather than a few large ones. This matters because it lowers the barrier for attackers and increases the volume of potential victims. Organizations should consider implementing payment verification delays, employee awareness training, and email filtering controls to disrupt these attacks at multiple points.
Key Takeaways
- Crime script analysis (CSA) decomposes attacks into narrative steps using everyday language, making attack descriptions accessible to non-technical audiences.
- AI can automate the time-consuming preparatory steps of BEC attacks (target selection, reconnaissance, lure crafting), enabling lower-value fraud at scale against many targets.
- Defenders can identify choke points in the attack script where interventions—such as honeypot organizations, AI provider detection, email rate-limiting, and payment verification processes—can disrupt the attack.
- CSA complements but does not replace MITRE ATT&CK; it provides an alternative abstraction layer for cross-team collaboration.
Affected Systems
- Business email systems
- Financial payment authorization processes
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Reconnaissance: Attacker uses AI to select victim organization, identify person with financial authority, find contact details, and identify a senior individual to impersonate
- Social Engineering: Attacker uses GenAI to craft a personalized message purportedly from the senior individual requesting urgent payment
- Delivery: Message is sent to the target victim via email
- Collection: If victim is fooled, payment is released to the attacker who launders funds to disguise origin
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the article. The article is conceptual and focuses on attack modeling and disruption strategy.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | The article describes a BEC fraud scenario that operates through email and social engineering. No endpoint telemetry is relevant to the described attack chain. |
| Network Visibility | Medium | Email delivery and anomalous outgoing mail volume are network-observable. The article suggests rate-limiting and reputation-based blocks by email service providers as a disruption point at Step 6. |
| Detection Difficulty | Hard | AI-crafted social engineering messages are personalized and may not match traditional phishing indicators. Distinguishing malicious AI prompts from legitimate business inquiries is difficult. Detection relies on behavioral anomalies rather than static signatures. |
Required Log Sources
- Email gateway logs
- Mail flow logs (outgoing volume and sender reputation)
- Financial transaction authorization logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for anomalous volumes of outgoing email from a single account or source, which may indicate a compromised mailbox being used for BEC delivery. | Email gateway logs, mail flow logs | Delivery | Medium — legitimate bulk email senders or marketing campaigns may trigger volume-based alerts. |
| Consider hunting for patterns of reconnaissance activity in LLM interaction logs, such as repeated queries about organizational structures or financial authority roles. | AI/LLM provider audit logs (if accessible) | Reconnaissance | High — legitimate business research and due diligence queries may resemble reconnaissance patterns. |
| Consider hunting for email messages requesting urgent payments that bypass normal procurement or purchase order verification processes. | Email content filtering logs, financial workflow logs | Social Engineering | Medium — legitimate urgent payment requests may occur in some business contexts. |
Control Gaps
- Traditional email security filters may not detect AI-crafted, personalized social engineering messages that lack typical phishing indicators.
- Static reputation-based blocking may not catch BEC messages sent from compromised legitimate accounts.
- AI provider logs are generally not accessible to defender organizations, limiting visibility into AI-facilitated reconnaissance.
Key Behavioral Indicators
- Email messages requesting urgent payment that reference senior individuals but originate from external or newly created accounts
- Sudden changes in email sending behavior from a previously low-volume account
- Payment requests that bypass established purchase order or verification workflows
- Messages with tone or language inconsistent with the purported sender's typical communication style
False Positive Assessment
Medium — Behavioral indicators such as urgent payment requests or anomalous email volume may occur in legitimate business contexts. AI-crafted messages may closely resemble genuine communications, making content-based detection unreliable without organizational context.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing recent payment requests for urgency language and bypass of standard verification procedures.
- Consider implementing mandatory delays for payments above a threshold that cannot be overridden by a single individual.
- Evaluate whether your email gateway can enforce rate-limiting on outgoing mail from individual accounts to detect compromised mailboxes used for BEC delivery.
Infrastructure Hardening
- Consider deploying email authentication protocols (DMARC, DKIM, SPF) in enforcement mode to reduce spoofing of internal senders.
- Evaluate whether your email security solution supports anomaly detection for sender behavior, not just content-based phishing detection.
- If applicable, consider seeding public-facing information with canary or honeypot organizational personas to detect AI-facilitated reconnaissance.
User Protection
- Consider requiring dual authorization for all financial transfers above a defined threshold.
- Evaluate whether purchase order verification processes can be made mandatory rather than optional for payment release.
- Consider implementing out-of-band verification (e.g., phone callback to a known number) for any payment request received via email.
Security Awareness
- Consider incorporating BEC scenarios into existing security awareness training, emphasizing that AI can now personalize messages at scale.
- Encourage employees to report emails with unusual tone, urgency, or payment requests that deviate from established processes.
- Consider briefing finance and accounting teams specifically on the risk of AI-crafted social engineering and the importance of verification delays.
