Email Forwarding Rule - Suspicious Folders

SIGMA detection rule by RedCanary, Sigma formatting by Micah Babinski · GPL-3.0

Looking for new rules alone may generate too many false positives, so adding another check for commonly abused folders, suspicious criteria, and odd names will help filter out benign activity. RedCanary suggests looking for new inbox rules that move or copy emails to the following folders. Part of the RedCanary 2024 Threat Detection Report.

title: Email Forwarding Rule - Suspicious Folders
id: f1595374-3a4a-4b40-aef5-0d854e043a14
status: experimental
description: |
    Looking for new rules alone may generate too many false positives, so adding another 
    check for commonly abused folders, suspicious criteria, and odd names will help 
    filter out benign activity. RedCanary suggests looking for new inbox rules that move or 
    copy emails to the following folders. Part of the RedCanary 2024 Threat Detection Report.
references:
    - https://redcanary.com/threat-detection-report/techniques/email-forwarding-rule/
author: RedCanary, Sigma formatting by Micah Babinski
date: 2024/03/21
tags:
    - attack.collection
    - attack.t1114
    - attack.t1114.003
logsource:
    service: exchange
    product: m365
detection:
    selection1:
        Workload: 'Exchange'
        Operation:
            - 'New-InboxRule'
            - 'Set-InboxRule'
        Parameters|contains: 'MoveToFolder'
    selection2:
        Parameters|contains:
            - 'RSS Feeds'
            - 'RSS Subscriptions'
            - 'Archive'
            - 'Deleted Items'
            - 'Conversation History'
    condition: all of selection*
falsepositives:
    - Unknown
level: low

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

413f2711-a8b2-4d3f-94f0-23a0d1735356

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion