Email hiding rules
noun · also Malicious inbox rules, Inbox rule abuse · MITRE ATT&CK T1564.008
Mailbox rules that an attacker creates in a compromised account to delete, move or mark messages as read, so the real owner does not notice the attack.
Inbox rules are a normal convenience: they file newsletters, flag messages from a manager or forward mail during a holiday. After taking over a mailbox, attackers use the same feature to stay hidden. A typical rule moves any message that mentions invoice, payment, phishing or hacked to an obscure folder such as RSS Feeds, marks it as read, or deletes it outright. Another may forward everything to an outside address.
The rule keeps working even after the attacker has left, and it is easy to miss because users rarely review their own rules. In Microsoft 365, rule creation and changes are recorded in the audit log as New-InboxRule, Set-InboxRule and UpdateInboxRules events.
Example
An attacker signs in to a finance employee's mailbox and creates a rule named "." that moves every message from the company's main supplier to RSS Feeds and marks it as read. When the supplier writes to ask why an invoice was paid to a different account, the employee never sees the message.
Why it matters for a SOC analyst
Checking inbox rules and forwarding should be part of every account compromise investigation, not only suspected fraud. A rule that hides mail about payments or security is a strong sign of compromise. Remove it, find out what it hid, and look for the same rule pattern in other mailboxes.
Related terms
- Business email compromise
Fraud in which an attacker impersonates or takes over a trusted business email account to redirect payments or obtain sensitive data.
- Phishing
A message that impersonates someone trustworthy to trick the recipient into clicking a link, opening a file, sharing credentials or sending money.
- Data exfiltration
The unauthorized transfer of data out of an organization, often the attacker's main goal or the leverage behind a ransomware extortion.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.