[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71B09B5RVM4GXD4K6C5FJ5H":3,"skill-same:01M71B09B5RVM4GXD4K6C5FJ5H":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":83},"01M71B09B5RVM4GXD4K6C5FJ5H","cyber-detecting-business-email-compromise-with-ai",null,"Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-detecting-business-email-compromise-with-ai\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"cyber detecting business email compromise with ai","cyber detecting business email compromise","email","business email compromise","business","with","detecting business email compromise with ai","detecting business email compromise","detecting","behavioral","patterns","security","analytics","defense","analyzing","subdomain","false","cybersecurity","filters","writing","2026-11-10 10:12:30",false,"---\nname: cyber-detecting-business-email-compromise-with-ai\ndescription: \"Deploy AI and NLP-powered detection systems to identify business email compromise attacks by analyzing writing style, behavioral patterns, and contextual anomalies that evade traditional rule-based filters.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: detecting-business-email-compromise-with-ai | description: Deploy AI and NLP-powered detection systems to identify business email |   compromise attacks by analyzing writing style, behavioral patterns, and contextual |   anomalies that evade traditional rule-based filters. | domain: cybersecurity | subdomain: phishing-defense | tags: | - bec | - ai | - nlp | - machine-learning | - email-security | - behavioral-analytics | - impersonation | - fraud-detection | version: '1.0' | author: mahip\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Detecting Business Email Compromise with AI\n\n## Overview\nAI-powered BEC detection uses machine learning, NLP, and behavioral analytics to identify sophisticated impersonation attacks that contain no malicious links or attachments. Traditional rule-based filters miss these attacks because BEC relies purely on social engineering. Modern AI approaches analyze writing style, tone, vocabulary, grammatical patterns, and behavioral context to determine if an email genuinely comes from the stated sender. BERT-based models achieve 98.65% accuracy in BEC detection, and AI-enhanced platforms show a 25% increase in phishing identification over keyword-based rules.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting business email compromise with ai\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n- AI-powered email security platform (Abnormal Security, Tessian, Microsoft Defender)\n- Historical email data for baseline training (minimum 30 days)\n- Integration with email platform (Microsoft 365 or Google Workspace)\n- SIEM for alert correlation and investigation\n- Understanding of BEC attack types (FBI IC3 classification)\n\n## Workflow\n\n### Step 1: Deploy AI Email Security Platform\n- Select API-based solution (Abnormal Security, Tessian, Ironscales) or enhance existing SEG\n- Connect to Microsoft Graph API or Google Workspace API\n- Allow 48-hour baseline learning period on historical email data\n- Configure integration to scan inbound, outbound, and internal email\n- Verify API permissions for message access and remediation\n\n### Step 2: Configure Behavioral Baselines\n- AI learns normal communication patterns: who emails whom, frequency, tone\n- Establish writing style profiles for each user (vocabulary, sentence structure)\n- Map typical request types per role (finance processes payments, HR handles PII)\n- Baseline email metadata: typical sending times, devices, locations\n- Flag deviations from established baselines as anomalous\n\n### Step 3: Train NLP Models for BEC Detection\n- Deploy transformer-based models (BERT, GPT) for email content analysis\n- Detect urgency and manipulation language patterns\n- Identify mismatches between sender identity and writing style\n- Analyze sentiment shifts indicating social engineering pressure\n- Classify email intent: information request, payment request, credential request\n\n### Step 4: Configure Detection Policies\n- VIP impersonation: AI compares new email against known executive communication patterns\n- Vendor impersonation: detect payment change requests from vendor lookalike domains\n- Account compromise: detect sudden changes in employee email behavior\n- Supply chain BEC: monitor for impersonation of trusted partners\n- Configure confidence thresholds for auto-block vs. warning banner vs. analyst review\n\n### Step 5: Integrate with Response Workflow\n- Auto-quarantine high-confidence BEC detections\n- Add warning banners for moderate-confidence detections\n- Route suspicious emails to SOC analyst queue for review\n- Integrate with SOAR for automated response playbooks\n- Feed BEC verdicts back into training data for model improvement\n\n## Tools & Resources\n- **Abnormal Security**: API-based AI email security with behavioral analysis\n- **Microsoft Defender for O365**: Built-in AI anti-BEC with Impostor Classifier\n- **Tessian (Proofpoint)**: AI-powered email security with human layer protection\n- **Ironscales**: AI + human-in-the-loop BEC detection\n- **Darktrace Email**: Self-learning AI for email threat detection\n\n## Validation\n- AI detects test BEC email with no malicious indicators (pure social engineering)\n- Writing style analysis identifies impersonation of known executive\n- Behavioral baseline flags unusual payment request from compromised account\n- NLP correctly classifies urgency manipulation in test scenario\n- False positive rate below 0.05% after baseline training\n- Detection rate exceeds traditional rule-based filters by 25%+\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Detecting Business Email Compromise with AI\n\n## Overview\nAI-powered BEC detection uses machine learning, NLP, and behavioral analytics to identify sophisticated impersonation attacks that contain no malicious links or attachments. Traditional rule-based filters miss these attacks because BEC relies purely on social engineering. Modern AI approaches analyze writing style, tone, vocabulary, grammatical patterns, and behavioral context to determine if an email genuinely comes from the stated sender. BERT-based models achieve 98.65% accuracy in BEC detection, and AI-enhanced platforms show a 25% increase in phishing identification over keyword-based rules.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting business email compromise with ai\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n- AI-powered email security platform (Abnormal Security, Tessian, Microsoft Defender)\n- Historical email data for baseline training (minimum 30 days)\n- Integration with email platform (Microsoft 365 or Google Workspace)\n- SIEM for alert correlation and investigation\n- Understanding of BEC attack types (FBI IC3 classification)\n\n## Workflow\n\n### Step 1: Deploy AI Email Security Platform\n- Select API-based solution (Abnormal Security, Tessian, Ironscales) or enhance existing SEG\n- Connect to Microsoft Graph API or Google Workspace API\n- Allow 48-hour baseline learning period on historical email data\n- Configure integration to scan inbound, outbound, and internal email\n- Verify API permissions for message access and remediation\n\n### Step 2: Configure Behavioral Baselines\n- AI learns normal communication patterns: who emails whom, frequency, tone\n- Establish writing style profiles for each user (vocabulary, sentence structure)\n- Map typical request types per role (finance processes payments, HR handles PII)\n- Baseline email metadata: typical sending times, devices, locations\n- Flag deviations from established baselines as anomalous\n\n### Step 3: Train NLP Models for BEC Detection\n- Deploy transformer-based models (BERT, GPT) for email content analysis\n- Detect urgency and manipulation language patterns\n- Identify mismatches between sender identity and writing style\n- Analyze sentiment shifts indicating social engineering pressure\n- Classify email intent: information request, payment request, credential request\n\n### Step 4: Configure Detection Policies\n- VIP impersonation: AI compares new email against known executive communication patterns\n- Vendor impersonation: detect payment change requests from vendor lookalike domains\n- Account compromise: detect sudden changes in employee email behavior\n- Supply chain BEC: monitor for impersonation of trusted partners\n- Configure confidence thresholds for auto-block vs. warning banner vs. analyst review\n\n### Step 5: Integrate with Response Workflow\n- Auto-quarantine high-confidence BEC detections\n- Add warning banners for moderate-confidence detections\n- Route suspicious emails to SOC analyst queue for review\n- Integrate with SOAR for automated response playbooks\n- Feed BEC verdicts back into training data for model improvement\n\n## Tools & Resources\n- **Abnormal Security**: API-based AI email security with behavioral analysis\n- **Microsoft Defender for O365**: Built-in AI anti-BEC with Impostor Classifier\n- **Tessian (Proofpoint)**: AI-powered email security with human layer protection\n- **Ironscales**: AI + human-in-the-loop BEC detection\n- **Darktrace Email**: Self-learning AI for email threat detection\n\n## Validation\n- AI detects test BEC email with no malicious indicators (pure social engineering)\n- Writing style analysis identifies impersonation of known executive\n- Behavioral baseline flags unusual payment request from compromised account\n- NLP correctly classifies urgency manipulation in test scenario\n- False positive rate below 0.05% after baseline training\n- Detection rate exceeds traditional rule-based filters by 25%+\n",{"hide":60,"name":5,"source":61,"license":15,"description":7,"authorized_lab":56,"origin_frontmatter":62},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: detecting-business-email-compromise-with-ai | description: Deploy AI and NLP-powered detection systems to identify business email |   compromise attacks by analyzing writing style, behavioral patterns, and contextual |   anomalies that evade traditional rule-based filters. | domain: cybersecurity | subdomain: phishing-defense | tags: | - bec | - ai | - nlp | - machine-learning | - email-security | - behavioral-analytics | - impersonation | - fraud-detection | version: '1.0' | author: mahip","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-detecting-business-email-compromise-with-ai",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-14 03:05:17",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":60},[73,76,79],{"tool":74,"command":75},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-detecting-business-email-compromise-with-ai",{"tool":77,"command":78},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-detecting-business-email-compromise-with-ai",{"tool":80,"command":81},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-detecting-business-email-compromise-with-ai","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-detecting-business-email-compromise-with-ai\u002FSKILL.md",[],[85,108,132,157,184,203],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":55},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[93,94,40,95,96,97,98,99,100,101,102,103,104,105,106,107],"zoom out","zoom","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":55},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[115,116,95,117,118,119,120,121,122,123,124,101,125,103,126,127,128,129,130,131],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":55},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[138],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140,141,142,143,144,145,146,147,148,103,149,150,151,152,153,154,37,119,155,156],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","cold outreach","frame",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":169,"publishedAt":55},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":167,"categoryName":168,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师",[170,105,171,140,95,172,173,174,119,175,176,177,178,179,180,181,182,183,101,103],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":190,"publishedAt":55},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[191,192,193,194,195,196,197,198,199,103,200,126,201,202],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":217,"publishedAt":55},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[209,212,213,216],{"categoryNo":210,"categoryName":211,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":214,"categoryName":215,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},[54,218,219,103,126,220,95,221,120,101,222],"writing skills","new","work","editing","Existing"]