Windows PowerShell: New-InboxRule/Set-InboxRule Script Block Activity
Detects PowerShell script content using Exchange cmdlets to create or update inbox rules with message-manipulation actions.
- Product
- windows
- Category
- ps_script
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2026-02-10
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that invokes Exchange cmdlets New-InboxRule or Set-InboxRule, indicating an inbox rule was created or modified. Attackers may use inbox rules to hide or manipulate incoming email, such as moving messages to other folders, marking them as read, deleting them, or filtering based on subject/body content. It relies on Script Block Logging telemetry where ScriptBlockText is available and contains both the cmdlet call and specific inbox rule actions or match conditions.
Reporting behind it
- redcanary.comhttps://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
- learn.microsoft.comhttps://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
- learn.microsoft.comhttps://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: New-InboxRule/Set-InboxRule Script Block Activity"
id: a21a1cd3-8364-4846-b257-a2e6c0b25327
related:
- id: d3577be1-42c9-44a7-b56e-2e8de97349d3
type: similar
- id: 04580eed-e1d6-426b-a570-f6e64a4577f7
type: derived
status: experimental
description: This rule flags PowerShell script block content that invokes Exchange cmdlets New-InboxRule or Set-InboxRule, indicating an inbox rule was created or modified. Attackers may use inbox rules to hide or manipulate incoming email, such as moving messages to other folders, marking them as read, deleting them, or filtering based on subject/body content. It relies on Script Block Logging telemetry where ScriptBlockText is available and contains both the cmdlet call and specific inbox rule actions or match conditions.
references:
- https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-02-10
tags:
- attack.stealth
- attack.t1564.008
- attack.exfiltration
- attack.collection
- attack.t1114.003
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmdlet:
ScriptBlockText|contains:
- New-InboxRule
- Set-InboxRule
selection_params:
ScriptBlockText|contains:
- DeleteMessage
- MarkAsRead
- MoveToFolder
- SubjectOrBodyContainsWords
condition: all of selection_*
falsepositives:
- Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.
level: medium
license: DRL-1.1