Inbox Rules Creation Or Update Activity in O365
Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails. The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails. Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Definition
Requirements: The 'Parameters' field is a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search
detection:
selection:
Operation:
- 'New-InboxRule'
- 'Set-InboxRule'
Parameters|contains:
- 'DeleteMessage'
- 'MarkAsRead'
- 'MoveToFolder'
- 'SubjectOrBodyContainsWords'
condition: selectionLegitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.
Other