Sigma rule: Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet

Rule

Title

Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet

Status

experimental

Level

medium

Author

Marco Pedrinazzi (@pedrinazziM) (InTheCyber)

Date

2026-02-10

File

rules-threat-hunting/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects inbox rule creation or update via ExchangePowerShell cmdlet, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.
The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.
Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection_cmdlet:
    ScriptBlockText|contains:
        - 'New-InboxRule'
        - 'Set-InboxRule'
selection_params:
    ScriptBlockText|contains:
        - 'DeleteMessage'
        - 'MarkAsRead'
        - 'MoveToFolder'
        - 'SubjectOrBodyContainsWords'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.

Tags

• attack.stealth
• attack.t1564.008
• attack.exfiltration
• attack.collection
• attack.t1114.003
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1114.003
• T1564.008

Related rules

• d3577be1-42c9-44a7-b56e-2e8de97349d3 (similar)

References

• https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
• https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
• https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml