Inbox Rules Creation Or Update Activity in O365

SIGMA detection rule by Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · NOASSERTION

Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails. The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails. Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.

title: Inbox Rules Creation Or Update Activity in O365
id: d3577be1-42c9-44a7-b56e-2e8de97349d3
status: experimental
description: |
    Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.
    The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.
    Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.
references:
    - https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
    - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
    - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-01-09
tags:
    - attack.stealth
    - attack.t1564.008
    - attack.exfiltration
    - attack.collection
    - attack.t1114.003
    - detection.threat-hunting
logsource:
    service: audit
    product: m365
    definition: "Requirements: The 'Parameters' field is a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search"
detection:
    selection:
        Operation:
            - 'New-InboxRule'
            - 'Set-InboxRule'
        Parameters|contains:
            - 'DeleteMessage'
            - 'MarkAsRead'
            - 'MoveToFolder'
            - 'SubjectOrBodyContainsWords'
    condition: selection
falsepositives:
    - Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.
level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0fce19e2-0388-452c-b964-403bf060469d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion