Microsoft 365 Audit Logs: Inbox Rule Creation or Update with Email Hiding Actions
Flags M365 audit events where inbox rules are created/updated with parameters that can delete, mark, move, or keyword-match messages.
- Product
- m365
- Service
- audit
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2026-01-09
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Microsoft 365 mailbox activity where an inbox rule is created or updated, specifically when the rule parameters include actions such as deleting messages, marking messages as read, moving messages to folders, or matching subject/body content. Attackers use inbox rules to alter the handling of incoming emails, helping evade review by suppressing or redirecting messages. The detection relies on M365 audit log events for inbox rule operations and on matching specific parameter values in those events.
Reporting behind it
- redcanary.comhttps://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
- learn.microsoft.comhttps://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
- learn.microsoft.comhttps://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Microsoft 365 Audit Logs: Inbox Rule Creation or Update with Email Hiding Actions"
id: 8515167e-e0b9-4f14-b618-146148cb1495
status: experimental
description: This rule flags Microsoft 365 mailbox activity where an inbox rule is created or updated, specifically when the rule parameters include actions such as deleting messages, marking messages as read, moving messages to folders, or matching subject/body content. Attackers use inbox rules to alter the handling of incoming emails, helping evade review by suppressing or redirecting messages. The detection relies on M365 audit log events for inbox rule operations and on matching specific parameter values in those events.
references:
- https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-01-09
tags:
- attack.stealth
- attack.t1564.008
- attack.exfiltration
- attack.collection
- attack.t1114.003
- detection.threat-hunting
logsource:
service: audit
product: m365
definition: "Requirements: The 'Parameters' field is a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search"
detection:
selection:
Operation:
- New-InboxRule
- Set-InboxRule
Parameters|contains:
- DeleteMessage
- MarkAsRead
- MoveToFolder
- SubjectOrBodyContainsWords
condition: selection
falsepositives:
- Legitimate inbox rules created by users or administrators to manage email flow such as filtering, organizing, or automating email handling.
level: medium
license: DRL-1.1
related:
- id: d3577be1-42c9-44a7-b56e-2e8de97349d3
type: derived