Sigma rule: Inbox Rules Creation Or Update Activity in O365

Rule

Title

Inbox Rules Creation Or Update Activity in O365

Status

experimental

Level

medium

Author

Marco Pedrinazzi (@pedrinazziM) (InTheCyber)

Date

2026-01-09

File

rules-threat-hunting/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.
The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.
Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.

Log source

product

m365

service

audit

definition

Requirements: The 'Parameters' field is a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search

Detection

selection:
    Operation:
        - 'New-InboxRule'
        - 'Set-InboxRule'
    Parameters|contains:
        - 'DeleteMessage'
        - 'MarkAsRead'
        - 'MoveToFolder'
        - 'SubjectOrBodyContainsWords'
condition: selection

False positives (as the rule lists them)

• Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.

Tags

• attack.stealth
• attack.t1564.008
• attack.exfiltration
• attack.collection
• attack.t1114.003
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1114.003
• T1564.008

References

• https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
• https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
• https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml