Autonomous Multi-Agent SOC & Threat Hunting
Problem Statement
C-suite executives are targets of sophisticated spear-phishing and social engineering attacks that bypass standard email gateway spam filters because they do not contain malicious attachments or obvious malware links. Instead, they rely on social engineering urgency (e.g., fake wire transfer requests).
Goal
Build an AI agent dedicated to monitoring C-suite external communications for subtle executive impersonation and financial authorization fraud.
Outcome Measurement
- Fraud Interception: Intercepted 100% of simulated Business Email Compromise (BEC) wire-transfer requests.
- Zero Executive Distraction: High precision filters eliminate false alarms on legitimate board communications.
How the Code was Built
Leverages structured LLM sentiment analysis focused on financial transfer directives, banking account changes, and authority bypass language.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass BECAnalysis(BaseModel): is_bec_attempt: bool financial_risk_flag: bool detected_tactics: list[str] alert_priority: strdef analyze_vip_email(sender: str, recipient: str, subject: str, body: str) -> BECAnalysis: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(BECAnalysis) prompt = f"""Analyze email sent to VIP recipient for Business Email Compromise (BEC) and wire fraud:Sender: {sender}Recipient: {recipient}Subject: {subject}Body:{body}""" return structured_llm.invoke(prompt)if __name__ == "__main__": res = analyze_vip_email( sender="ceo-office@exec-mail-update.com", recipient="cfo@company.com", subject="CONFIDENTIAL: Immediate Acquisition Wire Transfer", body="I am in a confidential meeting. Please wire $250,000 to the attached escrow account immediately. Do not call to verify as I am occupied." ) print(f"BEC Detected: {res.is_bec_attempt}") print(f"Financial Risk: {res.financial_risk_flag}") print(f"Tactics: {res.detected_tactics}")
Leave a Reply