{"id":"T1564.008","name":"Email Hiding Rules","url":"https://attack.mitre.org/techniques/T1564/008","tactics":["stealth"],"platforms":["Windows","Linux","macOS","Office Suite"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0192","stix_id":"x-mitre-detection-strategy--54aaab69-62fb-4d40-b2e0-0d07594353ed","name":"Detection Strategy for Email Hiding Rules","url":"https://attack.mitre.org/detectionstrategies/DET0192","analytics":[{"id":"AN0551","stix_id":"x-mitre-analytic--a09ed72b-be04-475f-8c0a-11ed47b40bd1","name":"Analytic 0551","description":"Suspicious creation or modification of inbox rules through PowerShell (New-InboxRule, Set-InboxRule) to automatically delete, move, or hide emails. Defender perspective: unusual rule activity correlated with mailbox access and filtering patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0192#AN0551","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"m365:unified","channel":"New-InboxRule or Set-InboxRule events recorded in Exchange Online","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"SuspiciousKeywords","description":"Keywords like 'phish', 'malware', 'suspicious' used in inbox rules to hide emails."},{"field":"UserContext","description":"Scope mailbox monitoring to high-value users such as executives or admins."}],"live":true,"detection_strategies":["DET0192"],"techniques":["T1564.008"]},{"id":"AN0552","stix_id":"x-mitre-analytic--863a9028-6b2a-46c6-b696-dd310937fbf9","name":"Analytic 0552","description":"Alterations to plist configuration files (RulesActiveState.plist, SyncedRules.plist, UnsyncedRules.plist, MessageRules.plist) that define email hiding or filtering rules. Defender perspective: unexpected changes in these files associated with Mail.app processes.","url":"https://attack.mitre.org/detectionstrategies/DET0192#AN0552","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Modifications to Mail.app plist files controlling message rules","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Mail.app executing with parameters updating rules state","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"WatchedPlistFiles","description":"Adjust to monitor only rule-related plist files relevant to the environment."}],"live":true,"detection_strategies":["DET0192"],"techniques":["T1564.008"]},{"id":"AN0553","stix_id":"x-mitre-analytic--487d9ddf-a790-4adc-9be4-ec5651e790f1","name":"Analytic 0553","description":"Rule manipulation through local email clients (e.g., Evolution, Thunderbird) or server-side filtering scripts (e.g., sieve) creating conditions to move or discard emails with security-related keywords.","url":"https://attack.mitre.org/detectionstrategies/DET0192#AN0553","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve calls modifying local mail filter configuration files","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"ApplicationLog:MailServer","channel":"Unexpected additions of sieve rules or filtering directives","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"applicationlog-mailserver"}],"mutable_elements":[{"field":"MailServerLogs","description":"Customize based on mail server software (Postfix, Dovecot, Exim)."}],"live":true,"detection_strategies":["DET0192"],"techniques":["T1564.008"]},{"id":"AN0554","stix_id":"x-mitre-analytic--747a2974-0c77-4c47-9c02-2775025327c6","name":"Analytic 0554","description":"Suspicious rule creation within Outlook or Exchange clients, including auto-move or delete conditions tied to incident or security alert keywords. Defender perspective: correlation between missing inbound emails and newly added mailbox rules.","url":"https://attack.mitre.org/detectionstrategies/DET0192#AN0554","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"Transport rule or inbox rule creation events","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"RuleScope","description":"Decide whether to monitor individual mailbox rules, org-wide transport rules, or both."}],"live":true,"detection_strategies":["DET0192"],"techniques":["T1564.008"]}],"live":true,"version":"1.0","techniques":["T1564.008"]}],"sigma_rules":[{"id":"04580eed-e1d6-426b-a570-f6e64a4577f7","title":"Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-02-10","modified":null,"description":"Detects inbox rule creation or update via ExchangePowerShell cmdlet, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.\nThe usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.\nAnalysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.\n","references":["https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1564.008","attack.exfiltration","attack.collection","attack.t1114.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml","techniques":["T1564.008","T1114.003"],"cves":[]},{"id":"0c7686d5-c74e-4292-b224-2a08e956ebc4","title":"Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet","author":"Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-03-01","modified":null,"description":"Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet","references":["https://redcanary.com/blog/email-forwarding-rules/","https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.collection","attack.stealth","attack.t1114.003","attack.t1564.008","attack.exfiltration","attack.t1020","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_email_forwarding_activity.yml","techniques":["T1114.003","T1564.008","T1020"],"cves":[]},{"id":"c726e007-2cd0-4a55-abfb-79730fbedee5","title":"Mail Forwarding/Redirecting Activity In O365","author":"RedCanary Team (idea), Harjot Singh @cyb3rjy0t","status":"test","level":"medium","date":"2023-10-11","modified":"2024-11-17","description":"Detects email forwarding or redirecting activity in O365 Audit logs.","references":["https://redcanary.com/blog/email-forwarding-rules/","https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf"],"logsource":{"product":"m365","service":"audit"},"tags":["attack.collection","attack.stealth","attack.t1114.003","attack.t1564.008","attack.exfiltration","attack.t1020","detection.threat-hunting"],"path":"rules-threat-hunting/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml","techniques":["T1114.003","T1564.008","T1020"],"cves":[]},{"id":"d3577be1-42c9-44a7-b56e-2e8de97349d3","title":"Inbox Rules Creation Or Update Activity in O365","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-01-09","modified":null,"description":"Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.\nThe usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.\nAnalysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.\n","references":["https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps"],"logsource":{"product":"m365","service":"audit"},"tags":["attack.stealth","attack.t1564.008","attack.exfiltration","attack.collection","attack.t1114.003","detection.threat-hunting"],"path":"rules-threat-hunting/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml","techniques":["T1564.008","T1114.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}