Cross-source coverage

T1564.008 / ATT&CK

Hide Artifacts: Email Hiding Rules

9 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule PowerShell cmdlets on Windows systems.

Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to Internal Spearphishing emails sent from the compromised account.

Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines.

In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions. Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).

Tactics
Stealth
Platforms
Windows · Linux · macOS · Office Suite
Telemetry
WinEventLog:PowerShellm365:unifiedmacos:unifiedlogauditd:SYSCALLApplicationLog:MailServer

How MITRE says to detect it DET0192

Detection Strategy for Email Hiding Rules

Windows Analytic 0551

Suspicious creation or modification of inbox rules through PowerShell (New-InboxRule, Set-InboxRule) to automatically delete, move, or hide emails. Defender perspective: unusual rule activity correlated with mailbox access and filtering patterns.

  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • m365:unified New-InboxRule or Set-InboxRule events recorded in Exchange Online

macOS Analytic 0552

Alterations to plist configuration files (RulesActiveState.plist, SyncedRules.plist, UnsyncedRules.plist, MessageRules.plist) that define email hiding or filtering rules. Defender perspective: unexpected changes in these files associated with Mail.app processes.

  • macos:unifiedlog Modifications to Mail.app plist files controlling message rules
  • macos:unifiedlog Mail.app executing with parameters updating rules state

Linux Analytic 0553

Rule manipulation through local email clients (e.g., Evolution, Thunderbird) or server-side filtering scripts (e.g., sieve) creating conditions to move or discard emails with security-related keywords.

  • auditd:SYSCALL execve calls modifying local mail filter configuration files
  • ApplicationLog:MailServer Unexpected additions of sieve rules or filtering directives

Office Suite Analytic 0554

Suspicious rule creation within Outlook or Exchange clients, including auto-move or delete conditions tied to incident or security alert keywords. Defender perspective: correlation between missing inbound emails and newly added mailbox rules.

  • m365:unified Transport rule or inbox rule creation events

View on attack.mitre.org ↗

SigmaHQ/sigma

4 rules
Detection Severity Format
Inbox Rules Creation Or Update Activity in O365 Medium Sigma
Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet Medium Sigma
Mail Forwarding/Redirecting Activity In O365 Medium Sigma
Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet Medium Sigma

splunk/security_content

3 rules
Detection Severity Format
O365 BEC Email Hiding Rule Created Undefined SPL
O365 Email New Inbox Rule Created Undefined SPL
O365 Email Transport Rule Changed Undefined SPL

elastic/detection-rules

2 rules
Detection Severity Format
M365 Exchange Inbox Phishing Evasion Rule Created High Elastic TOML
M365 Exchange Inbox Rule with Obfuscated Name Medium Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.