A rule that moves security alerts to an obscure folder is quiet, legal mailbox behavior. MITRE T1564.008, Email Hiding Rules, is about adversaries using it against you. It sits under the stealth tactic and applies to Windows, Linux, macOS and Office Suite environments.
How attackers use it
Many email clients let users build inbox rules that move messages, mark them as read or delete them. Rules can be made in the client, or with the New-InboxRule and Set-InboxRule PowerShell cmdlets on Windows.
MITRE says adversaries use rules in a compromised mailbox to delete or move mail to less noticeable folders. The aim is to hide security alerts, command and control communication, or replies to Internal Spearphishing emails sent from the compromised account. Rules commonly match keywords in subjects and bodies, such as malware, suspicious, phish and hack.
There is an organization-wide version too. In Microsoft Exchange, transport rules evaluate all mail the organization receives and act on matches. An adversary who can abuse them may be able to modify or delete all mail on a topic, such as internal security reports.
How to detect it
MITRE's analytics cover several clients:
- Suspicious use of
New-InboxRuleorSet-InboxRulethat deletes, moves or hides mail, correlated with mailbox access. - On macOS, changes to the Mail.app rule files RulesActiveState.plist, SyncedRules.plist, UnsyncedRules.plist and MessageRules.plist.
- Rule changes in local clients such as Evolution and Thunderbird, or server-side filtering scripts such as sieve, with conditions that discard mail containing security keywords.
- New Outlook or Exchange rules with auto-move or delete conditions tied to incident or alert words.
The best human signal is simple: a user or the security team notices that expected mail is missing, and a new rule explains it.
How to reduce the risk
MITRE lists one mitigation, Audit. Enterprise email solutions can audit inbox rules on a regular basis. In Exchange, administrators can use Get-InboxRule and Remove-InboxRule for inbox rules and Get-TransportRule and Remove-TransportRule for transport rules to find and remove ones that look malicious.
Turn that into routine: review rules on a schedule, and always review rules on any mailbox you suspect is compromised.
Check your own environment
In Exchange Online PowerShell, read-only listings:
Get-InboxRule -Mailbox user@example.com | Format-List Name,Enabled,DeleteMessage,MoveToFolder,MarkAsRead,SubjectOrBodyContainsWords
Get-TransportRule | Format-Table Name,State,Priority
Replace the address with a real mailbox. Look for rules that delete mail, send it to RSS or archive folders, or match words like phish and malware. On a Mac, review the Mail rules in Mail settings.
Quick check
Why would an adversary create a rule matching the word phish?
To delete or bury messages that would alert the user or defenders, such as security warnings and replies to internal phishing.
What is the organization-wide variant in Exchange?
Transport rules, which evaluate all mail the organization receives and can modify or delete mail on chosen topics.
