Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
44 detections
Filters
Last updated
All Time
Detection languages
22
9
4
3
2
Contributors
18
8
4
4
1
Categories
33
23
9
7
7
Platforms
39
11
2
2
1
Products / Services
39
17
3
2
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
1
IDS Protocols
1
This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account.
Detects the creation or modification of Exchange mailbox rules using the New-InboxRule or Set-InboxRule cmdlets that perform automatic forwarding or redirection of email to external, non-trusted domains. This technique is commonly employed during account takeover events to facilitate covert data exfiltration.
Detects the creation or modification of inbox rules in Microsoft 365 Exchange environments that perform suspicious actions such as forwarding, redirecting, moving, or deleting emails. This rule specifically monitors for rule configurations that target potentially sensitive keywords, indicating a likely attempt to exfiltrate data, hide security alerts, or intercept communications.
Detects the creation or modification of mailbox inbox rules that configure forwarding or redirection to external addresses, or rules that automatically delete or move messages based on sensitive keyword filters (e.g., 'invoice', 'password'). It specifically looks for indicators of mailbox hiding (hidden rules) which are frequently used by attackers to maintain persistence and conceal activity, particularly following unauthorized access or token theft.
Detects a sequence where an OAuth application is granted 'Mail.ReadWrite' or 'MailboxSettings.ReadWrite' permissions, followed shortly thereafter (within 4 hours) by the creation or modification of an Inbox Rule by that same application within the same mailbox. This pattern is indicative of a persistence mechanism where an adversary uses elevated OAuth permissions to manipulate mailbox mail flow rules for stealth or exfiltration.
This rule detects potentially malicious inbox rule creation or modification in Office 365 Exchange. It flags rules that contain keywords associated with financial fraud (e.g., invoice, wire, payment) and include actions that hide evidence (e.g., moving messages to junk or deleting them). It further correlates these actions with suspicious user login activity, such as logging in from a new IP address or country within an hour of the rule change, which is a common indicator of a Business Email Compromise (BEC) account takeover.
Detects the creation of suspicious O365 inbox rules designed to hide (via mark-as-read, move, or delete actions) or forward/redirect email messages containing keywords associated with financial transactions such as payment, wire, or invoice. This behavior is indicative of post-compromise activity, specifically targeted at invoice fraud or email thread hijacking.
Detects the creation or modification of inbox rules in Office 365 that exhibit suspicious characteristics, such as external forwarding, automatic deletion/moving of sensitive emails (e.g., security alerts, junk), or rules containing keywords related to fraud. The rule optionally correlates this activity with recent anomalous sign-in attempts by the same user to identify potential account compromise.
Detects the creation or modification of inbox rules in Microsoft 365 that filter messages containing financial keywords (e.g., 'direct deposit', 'bank') and perform actions designed to hide or suppress these emails (e.g., 'MoveToFolder', 'DeleteMessage', 'MarkAsRead', 'StopProcessingRules'). This behavior is commonly used by adversaries to hide notification emails regarding financial transactions, which could alert the user to unauthorized activity.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
This rule monitors for the creation or modification of inbox rules in Microsoft 365 that contain financial-related keywords (e.g., 'payment', 'wire', 'invoice') and disruptive actions such as deleting, moving, forwarding, or redirecting messages. These patterns are characteristic of Business Email Compromise (BEC) attacks, where adversaries attempt to conceal financial correspondence from the victim to facilitate fraudulent transactions.
Detects the creation of email mailbox or transport rules that perform actions like hiding, deleting, marking as read, forwarding, or redirecting emails with finance or payment-related keywords. This behavior is indicative of a Business Email Compromise (BEC) post-exploitation workflow where adversaries attempt to conceal malicious activity or divert financial communications.
Detects the creation or modification of email inbox rules that perform suspicious actions such as deleting, moving to folders, or forwarding emails, specifically when those rules target keywords associated with sensitive financial or business communications like invoices, payments, or wire transfers. This behavior is indicative of an attacker attempting to hide evidence of a compromise or intercept sensitive business communications.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
Detects the creation or modification of inbox and transport rules in Office 365 that perform automatic email actions such as redirecting, forwarding, deleting, or marking emails as read, especially when targeting keywords related to sensitive information (e.g., invoice, payment, vendor, bank). This behavior is often associated with email account compromise and data exfiltration or persistence strategies.
Detects the creation or modification of email inbox rules that perform actions such as forwarding, deleting, or moving messages combined with keywords often associated with financial fraud, business email compromise (BEC), or credential harvesting. Adversaries often use these rules to hide communications, redirect financial emails, or automate data exfiltration.
Detects the creation of email inbox rules in Microsoft 365 where the rule name is exceptionally short ('.' or '..') and the rule performs potentially malicious actions such as forwarding, redirecting, or deleting incoming messages. This is a common technique used by attackers to hide malicious email activity or exfiltrate sensitive data from a compromised account.
Detects the creation of an inbox rule in Microsoft 365 occurring shortly after a user's mailbox items were accessed. This pattern is often indicative of account compromise where an adversary accesses a mailbox to identify sensitive information and subsequently creates inbox rules (e.g., to redirect or delete emails) to maintain persistence or conceal their activity.
Detects creation of malicious Exchange inbox rules (move to Deleted Items / mark as read) correlated via SessionId to an interactive sign-in from the Datawagon hosting ASN (27176) and a subsequent MailItemsAccessed event, consistent with Storm-2755 AiTM session-replay and mailbox-hiding persistence.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
Page 1 of 3