Microsoft 365 mailbox hiding rule
A Microsoft 365 mailbox inbox rule (UpdateInboxRules / New-InboxRule / Set-InboxRule) whose actions delete, permanently delete, mark-as-read, move, or…
What it detects
A Microsoft 365 mailbox inbox rule (UpdateInboxRules / New-InboxRule / Set-InboxRule) whose actions delete, permanently delete, mark-as-read, move, or forward incoming mail. Attackers who take over a mailbox create a "hiding" rule so the victim never sees replies to fraudulent mail (BEC) — the rule silently files or destroys the responses. This is post-compromise persistence and defense-evasion that survives a password reset, and the exact move seen when a rule like "DDX" with DeleteAction/PermanentDeleteAction appears from a mailbox.
MITRE ATT&CK mapping
False positives and triage
People do create legitimate filing rules that move or mark mail read. The signal is a rule that DELETES or PERMANENTLY DELETES incoming mail, or forwards it outside, especially one created from an unfamiliar client IP or right after a suspicious sign-in. Confirm the mailbox owner did not create it, and inspect the rule name and its full action list in the event evidence.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/m365_mailbox_hiding_rule.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mailbox_hiding_rule
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [application]
mitre_techniques: [T1564.008, T1114.003]
description: |
A Microsoft 365 mailbox inbox rule (UpdateInboxRules / New-InboxRule /
Set-InboxRule) whose actions delete, permanently delete, mark-as-read, move, or
forward incoming mail. Attackers who take over a mailbox create a "hiding" rule
so the victim never sees replies to fraudulent mail (BEC) — the rule silently
files or destroys the responses. This is post-compromise persistence and
defense-evasion that survives a password reset, and the exact move seen when a
rule like "DDX" with DeleteAction/PermanentDeleteAction appears from a mailbox.
match:
provider: Office365
event_action_any:
- UpdateInboxRules
- New-InboxRule
- Set-InboxRule
raw_message_contains_any:
- "DeleteAction"
- "PermanentDeleteAction"
- "MarkAsReadAction"
- "MoveToFolder"
- "ForwardTo="
- "RedirectTo="
- "ForwardAsAttachmentTo="
correlation_keys: [user_name]
false_positive_guidance: |
People do create legitimate filing rules that move or mark mail read. The signal
is a rule that DELETES or PERMANENTLY DELETES incoming mail, or forwards it
outside, especially one created from an unfamiliar client IP or right after a
suspicious sign-in. Confirm the mailbox owner did not create it, and inspect the
rule name and its full action list in the event evidence.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.