Exchange Repeated Mail Drops Suggesting Transport Rule Tampering
Detects a rise in dropped or suppressed mail. Transport rules that silently discard messages can be used to hide security alerts, suppress notifications of account changes, or conceal an ongoing compromise from the people who would otherwise notice it. Mail that never arrives generates no complaint for some time, which is precisely why this is worth watching. Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='MS-EXCHANGE' and action in ('EMAIL_DROPPED', 'EMAIL_SUPPRESSED') | duration 1h | groupby recipient, sender, direction
Sigma
