Techniques › T1564 › T1564.008
T1564.008 Email Hiding Rules
stealth — Windows, Linux, macOS, Office Suite · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
4
Sigma rules tagged attack.t1564.008
0
KEV CVEs mapped here
<p>Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the <code>New-InboxRule</code> or <code>Set-InboxRule</code> PowerShell cmdlets on Windows systems.</p><p>Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to Internal Spearphishing emails sent from the compromised account.</p><p>Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as <code>malware</code>, <code>suspicious</code>, <code>phish</code>, and <code>hack</code>) found in message bodies and subject lines.</p><p>In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions. Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0192 Detection Strategy for Email Hiding Rules v1.0
AN0551 WindowsSuspicious creation or modification of inbox rules through PowerShell (New-InboxRule, Set-InboxRule) to automatically delete, move, or hide emails. Defender perspective: unusual rule activity correlated with mailbox access and filtering patterns.m365:unified
New-InboxRule or Set-InboxRule events recorded in Exchange Online→ DC0038 Application Log ContentTunable:SuspiciousKeywordsUserContextAN0552 macOSAlterations to plist configuration files (RulesActiveState.plist, SyncedRules.plist, UnsyncedRules.plist, MessageRules.plist) that define email hiding or filtering rules. Defender perspective: unexpected changes in these files associated with Mail.app processes.macos:unifiedlogModifications to Mail.app plist files controlling message rules→ DC0061 File ModificationTunable:WatchedPlistFilesAN0553 LinuxRule manipulation through local email clients (e.g., Evolution, Thunderbird) or server-side filtering scripts (e.g., sieve) creating conditions to move or discard emails with security-related keywords.auditd:SYSCALLexecve calls modifying local mail filter configuration files→ DC0064 Command ExecutionApplicationLog:MailServerUnexpected additions of sieve rules or filtering directives→ DC0038 Application Log ContentTunable:MailServerLogsAN0554 Office SuiteSuspicious rule creation within Outlook or Exchange clients, including auto-move or delete conditions tied to incident or security alert keywords. Defender perspective: correlation between missing inbound emails and newly added mailbox rules.Tunable:RuleScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1564.008
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-02-10 · logsource: product=windows category=ps_script · 04580eed-e1d6-426b-a570-f6e64a4577f7
Detects inbox rule creation or update via ExchangePowerShell cmdlet, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.
The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.
Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.
Author: Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-03-01 · logsource: product=windows category=ps_script · 0c7686d5-c74e-4292-b224-2a08e956ebc4
Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet
Author: RedCanary Team (idea), Harjot Singh @cyb3rjy0t
· 2023-10-11 (modified 2024-11-17) · logsource: product=m365 service=audit · c726e007-2cd0-4a55-abfb-79730fbedee5
Detects email forwarding or redirecting activity in O365 Audit logs.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-01-09 · logsource: product=m365 service=audit · d3577be1-42c9-44a7-b56e-2e8de97349d3
Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.
The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.
Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.
Rules tagged at the parent level (attack.t1564) 10
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: frack113
· 2021-06-04 (modified 2022-08-02) · logsource: product=windows category=sysmon_status · 1f2b5353-573f-4880-8e33-7d04dcf97744
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Author: Tobias Michalski (Nextron Systems)
· 2022-02-24 (modified 2023-08-17) · logsource: product=windows category=registry_set · 2ff692c2-4594-41ec-8fcb-46587de769e0
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Author: Florian Roth (Nextron Systems)
· 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Author: frack113
· 2022-09-05 (modified 2023-12-11) · logsource: product=windows category=file_event · 74babdd6-a758-4549-9632-26535279e654
Detect creation of suspicious executable file names.
Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
Author: Florian Roth (Nextron Systems)
· 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · 811e0002-b13b-4a15-9d00-a613fce66e42
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Author: frack113
· 2021-06-04 (modified 2026-07-23) · logsource: product=windows category=sysmon_error · 815cd91b-7dbc-4247-841a-d7dd1392b0a8
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Author: Janantha Marasinghe
· 2020-09-26 (modified 2025-07-29) · logsource: product=windows category=process_creation · bab049ca-7471-4828-9024-38279a4c04da
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
Author: frack113
· 2022-01-21 (modified 2023-01-05) · logsource: product=windows category=file_event · e15b518d-b4ce-4410-a9cd-501f23ce4a18
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-01-12 · logsource: product=linux category=process_creation · ec52985a-d024-41e3-8ff6-14169039a0b3
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system