AiTM - Post-Compromise Inbox Rule Creation (T1098.005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•8

Detects the attacker leveraging a stolen token to create or modify inbox rules (e.g., moving emails to RSS Subscriptions or Archive) to hide their activities. This rule specifically looks for actions like 'New-InboxRule' or 'Set-InboxRule' with parameters indicating email manipulation such as 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead'.