Kali365 - Concealment Inbox Rule Creation (T1098.005)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•3•0•3

Detects the Kali365 framework automatically establishing mailbox rules to delete or hide security alerts, finance emails, or replies from the phished user. The rule specifically looks for the creation or modification of inbox rules that involve actions like 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead' and are applied to emails containing keywords such as 'phish', 'security', 'alert', 'finance', or 'invoice'.