Microsoft 365 Audit: Inbox Rule Creation or Update with Email-Hiding Actions

Flags M365 audit events where inbox rules are created/updated with parameters that can delete, mark, move, or keyword-match messages.

FreeUnreviewedSigmamediumv1

microsoft-365-audit-inbox-rule-creation-or-update-with-email-hiding-actions-d3577be1

title: "Microsoft 365 Audit: Inbox Rule Creation or Update with Email-Hiding Actions"
id: 8515167e-e0b9-4f14-b618-146148cb1495
status: experimental
description: This rule identifies creation or modification of Exchange inbox rules recorded in Microsoft 365 audit logs where the rule parameters include actions commonly used to alter message handling (e.g., DeleteMessage, MarkAsRead, MoveToFolder, or matching Subject/Body keywords). Attackers can use inbox rules to hide or redirect targeted emails to reduce visibility and impede incident detection. The detection relies on audit log events for New-InboxRule and Set-InboxRule and inspects the rule parameters content for the specified actions.
references:
  - https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-01-09
tags:
  - attack.stealth
  - attack.t1564.008
  - attack.exfiltration
  - attack.collection
  - attack.t1114.003
  - detection.threat-hunting
logsource:
  service: audit
  product: m365
  definition: "Requirements: The 'Parameters' field is a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search"
detection:
  selection:
    Operation:
      - New-InboxRule
      - Set-InboxRule
    Parameters|contains:
      - DeleteMessage
      - MarkAsRead
      - MoveToFolder
      - SubjectOrBodyContainsWords
  condition: selection
falsepositives:
  - Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.
level: medium
license: DRL-1.1
related:
  - id: d3577be1-42c9-44a7-b56e-2e8de97349d3
    type: derived

What it detects

This rule identifies creation or modification of Exchange inbox rules recorded in Microsoft 365 audit logs where the rule parameters include actions commonly used to alter message handling (e.g., DeleteMessage, MarkAsRead, MoveToFolder, or matching Subject/Body keywords). Attackers can use inbox rules to hide or redirect targeted emails to reduce visibility and impede incident detection. The detection relies on audit log events for New-InboxRule and Set-InboxRule and inspects the rule parameters content for the specified actions.

Known false positives

Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.