ExchangePowerShell Inbox Rule Creation or Update via New-InboxRule/Set-InboxRule (Windows PowerShell)

Detects PowerShell script content using Exchange cmdlets to create or update inbox rules with message-manipulation actions.

FreeUnreviewedSigmamediumv1

exchangepowershell-inbox-rule-creation-or-update-via-new-inboxrule-set-inboxrule-04580eed

title: ExchangePowerShell Inbox Rule Creation or Update via New-InboxRule/Set-InboxRule (Windows PowerShell)
id: a21a1cd3-8364-4846-b257-a2e6c0b25327
related:
  - id: d3577be1-42c9-44a7-b56e-2e8de97349d3
    type: similar
  - id: 04580eed-e1d6-426b-a570-f6e64a4577f7
    type: derived
status: experimental
description: This rule flags PowerShell script block activity containing ExchangePowerShell cmdlets used to create or modify mailbox inbox rules. It matters because attackers can use inbox rules to suppress, mark, or redirect messages, helping evade monitoring and disrupt incident visibility. The detection relies on Script Block Logging telemetry and matches script content that includes New-InboxRule or Set-InboxRule along with inbox-rule-related actions such as deleting, marking as read, moving messages, or filtering on subject/body text.
references:
  - https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-02-10
tags:
  - attack.stealth
  - attack.t1564.008
  - attack.exfiltration
  - attack.collection
  - attack.t1114.003
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - New-InboxRule
      - Set-InboxRule
  selection_params:
    ScriptBlockText|contains:
      - DeleteMessage
      - MarkAsRead
      - MoveToFolder
      - SubjectOrBodyContainsWords
  condition: all of selection_*
falsepositives:
  - Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block activity containing ExchangePowerShell cmdlets used to create or modify mailbox inbox rules. It matters because attackers can use inbox rules to suppress, mark, or redirect messages, helping evade monitoring and disrupt incident visibility. The detection relies on Script Block Logging telemetry and matches script content that includes New-InboxRule or Set-InboxRule along with inbox-rule-related actions such as deleting, marking as read, moving messages, or filtering on subject/body text.

Known false positives

Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.