Azure risk detection: Suspicious inbox manipulation rules set to delete or move items

Alerts on Azure risk events for suspicious inbox rules that delete or move mailbox items.

FreeUnreviewedSigmahighv1

azure-risk-detection-suspicious-inbox-manipulation-rules-set-to-delete-or-move-i-ceb55fd0

title: "Azure risk detection: Suspicious inbox manipulation rules set to delete or move items"
id: 2f580dbd-0e59-4acd-9b82-42b2019cf275
status: test
description: This rule flags Azure risk events indicating suspicious inbox manipulation rules have been set on a user’s inbox. Attackers may abuse mailbox rules to silently delete or move messages, reducing the chance of detection or interfering with notifications. The detection relies on Azure risk telemetry with riskEventType equal to mcasSuspiciousInboxManipulationRules.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: mcasSuspiciousInboxManipulationRules
  condition: selection
falsepositives:
  - Actual mailbox rules that are moving items based on their workflow.
level: high
license: DRL-1.1
related:
  - id: ceb55fd0-726e-4656-bf4e-b585b7f7d572
    type: derived

What it detects

This rule flags Azure risk events indicating suspicious inbox manipulation rules have been set on a user’s inbox. Attackers may abuse mailbox rules to silently delete or move messages, reducing the chance of detection or interfering with notifications. The detection relies on Azure risk telemetry with riskEventType equal to mcasSuspiciousInboxManipulationRules.

Known false positives

Actual mailbox rules that are moving items based on their workflow.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.