Elastic high stable kql

M365 Exchange Inbox Phishing Evasion Rule Created

Identifies when a user creates a new inbox rule in Microsoft 365 that deletes or moves emails containing suspicious keywords. Adversaries who have compromised accounts often create inbox rules to hide alerts, security notifications, or other sensitive messages by automatically deleting them or moving them to obscure folders. Common destinations include Deleted Items, Junk Email, RSS Feeds, and RSS Subscriptions. This is a New Terms rule that triggers only when the user principal name and associated source IP address have not been observed performing this activity in the past 14 days.

View Source

Detection Logic

data_stream.dataset: "o365.audit" and
    event.action: ("New-InboxRule" or "Set-InboxRule") and event.outcome: "success" and
    (
     o365.audit.Parameters.BodyContainsWords: "\u0000" or 
     o365.audit.Parameters.WithinSizeRangeMinimum <= 1023 or 
     o365.audit.Parameters.SubjectContainsWords: (
        *phish* or
        *hack* or
        *alert* or
        *malware* or
        *security* or
        *invoice* or
        *payment* or
        *wire* or
        *transfer* or
        *fraud* or
        *reset* or
        *unusual* or
        *protection* or
        *login* or
        *suspicious*
      )
    ) and (
    o365.audit.Parameters.DeleteMessage: True or
    o365.audit.Parameters.MoveToFolder: (
        *Deleted* or
        *Junk* or
        *RSS* or 
        *Calendar*
    )
)

Field Validations

Loading…

Comments (0)

Loading comments...