Microsoft 365 payment mail hiding rule
An inbox rule was created that hides incoming mail from PAYMENT or CONTRACT senders — QuickBooks, DocuSign, Adobe Sign, BILL, Xero and the like.
What it detects
An inbox rule was created that hides incoming mail from PAYMENT or CONTRACT senders — QuickBooks, DocuSign, Adobe Sign, BILL, Xero and the like.
This is invoice fraud, not housekeeping. The attacker's problem after taking a mailbox is that the victim will see the real invoice and compare it with the fraudulent one; a rule that files those notifications away — usually into RSS Feeds, marked read — solves it. The rule is the fraud's enabling step, and it is usually created within minutes of the first successful sign-in from the attacker's address.
The motivating case: a rule named "." with FromAddressContainsWords: quickbooks@notification.intuit.com;@docusign.net, MoveToFolder: RSS Feeds, MarkAsRead: True. Every field was already in the evidence; the product could only report "a hiding rule was created" because a rule could not read the rule's own parameters. ext: addressing makes the purpose detectable, which is what turns a medium finding into a critical one.
MITRE ATT&CK mapping
False positives and triage
A finance user who genuinely files invoice notifications into a folder will match. Two things separate that from fraud, and both are in the evidence: WHERE the mail goes (a working folder versus RSS Feeds, Deleted Items or Junk), and whether MarkAsRead is set — nobody files their own invoices unread. Also check who created it: a rule made from an address the account has never used before, minutes after a sign-in, is the fraud pattern. Confirm with the mailbox owner before acting; this names a lead, and a very strong one, but the analyst owns the verdict.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/cloud/m365_payment_mail_hiding_rule.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_payment_mail_hiding_rule
version: 1.0.0
status: stable
severity: critical
confidence: 0.75
platforms: [application]
mitre_techniques: [T1564.008, T1114.003, T1657]
description: |
An inbox rule was created that hides incoming mail from PAYMENT or CONTRACT
senders — QuickBooks, DocuSign, Adobe Sign, BILL, Xero and the like.
This is invoice fraud, not housekeeping. The attacker's problem after taking a
mailbox is that the victim will see the real invoice and compare it with the
fraudulent one; a rule that files those notifications away — usually into RSS
Feeds, marked read — solves it. The rule is the fraud's enabling step, and it
is usually created within minutes of the first successful sign-in from the
attacker's address.
The motivating case (ADR-053): a rule named "." with
`FromAddressContainsWords: quickbooks@notification.intuit.com;@docusign.net`,
`MoveToFolder: RSS Feeds`, `MarkAsRead: True`. Every field was already in the
evidence; the product could only report "a hiding rule was created" because a
rule could not read the rule's own parameters. `ext:` addressing makes the
purpose detectable, which is what turns a medium finding into a critical one.
match:
provider: Office365
event_action_contains_any:
- InboxRule
- UpdateInboxRules
# Sender lists live under `Parameters: [{Name, Value}, …]`; the whole subtree is
# searched, so this does not depend on an array index the source may reorder.
ext:Parameters_contains_any:
# knowledge/business-context.yaml -> payment_and_contract_senders
- "quickbooks@"
- "@intuit.com"
- "@docusign.net"
- "@docusign.com"
- "@adobesign.com"
- "echosign@"
- "@bill.com"
- "@xero.com"
- "@stripe.com"
- "service@paypal"
- "@sage.com"
- "@netsuite.com"
- "remittance"
- "payment advice"
correlation_keys: [user_name]
false_positive_guidance: |
A finance user who genuinely files invoice notifications into a folder will
match. Two things separate that from fraud, and both are in the evidence:
WHERE the mail goes (a working folder versus RSS Feeds, Deleted Items or Junk),
and whether `MarkAsRead` is set — nobody files their own invoices unread. Also
check who created it: a rule made from an address the account has never used
before, minutes after a sign-in, is the fraud pattern. Confirm with the mailbox
owner before acting; per ADR-004 this names a lead, and a very strong one, but
the analyst owns the verdict.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.