Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
44 detections
Filters
Last updated
All Time
Detection languages
22
9
4
3
2
Contributors
18
8
4
4
1
Categories
33
23
9
7
7
Platforms
39
11
2
2
1
Products / Services
39
17
3
2
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
This analytic identifies the creation or modification of email inbox rules within an Office 365 environment. It specifically looks for `New-InboxRule` and `Set-InboxRule` operations in the O365 management activity logs where the rule parameters indicate actions such as mail forwarding (`ForwardTo`, `ForwardAsAttachmentTo`, `RedirectTo`), or mail manipulation like deletion (`SoftDeleteMessage`, `DeleteMessage`) or moving to specific folders (`MoveToFolder`, `CopyToFolder`). While legitimate users create inbox rules, adversaries often leverage these techniques to exfiltrate emails, maintain persistence, or hide their activities by deleting or moving security alerts.
This analytic identifies when a user with sufficient access to Exchange Online alters the mail flow/transport rule configuration of the organization. Transport rules are a set of rules that can be used by attackers to modify or delete emails based on specific conditions. This activity could indicate an attacker hiding or exfiltrating data by manipulating email flow.
Page 3 of 3