T1564.008 Email Hiding Rules
Adversaries may use email rules to hide inbound emails in a compromised user’s mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule
or Set-InboxRule
PowerShell cmdlets on Windows systems.4156
Adversaries may utilize email rules within a compromised user’s mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to Internal Spearphishing emails sent from the compromised account.
Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware
, suspicious
, phish
, and hack
) found in message bodies and subject lines. 7
In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.3 Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).
Item | Value |
---|---|
ID | T1564.008 |
Sub-techniques | T1564.001, T1564.002, T1564.003, T1564.004, T1564.005, T1564.006, T1564.007, T1564.008, T1564.009, T1564.010 |
Tactics | TA0005 |
Platforms | Google Workspace, Linux, Office 365, Windows, macOS |
Version | 1.2 |
Created | 07 June 2021 |
Last Modified | 12 April 2023 |
Procedure Examples
ID | Name | Description |
---|---|---|
G0085 | FIN4 | FIN4 has created rules in victims’ Microsoft Outlook accounts to automatically delete emails containing words such as “hacked,” “phish,” and “malware” in a likely attempt to prevent organizations from communicating about their activities.10 |
Mitigations
ID | Mitigation | Description |
---|---|---|
M1047 | Audit | Enterprise email solutions may have monitoring mechanisms that may include the ability to audit inbox rules on a regular basis. |
Detection
ID | Data Source | Data Component |
---|---|---|
DS0015 | Application Log | Application Log Content |
DS0017 | Command | Command Execution |
DS0022 | File | File Modification |
References
-
Apple. (n.d.). Use rules to manage emails you receive in Mail on Mac. Retrieved June 14, 2021. ↩
-
Carr, N., Sellmer, S. (2021, June 14). Behind the scenes of business email compromise: Using cross-domain threat data to disrupt a large BEC campaign. Retrieved June 15, 2021. ↩
-
Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023. ↩
-
Microsoft. (n.d.). Manage email messages by using rules. Retrieved June 11, 2021. ↩
-
Niv Goldenberg. (2018, December 12). Rule your inbox with Microsoft Cloud App Security. Retrieved June 7, 2021. ↩
-
Microsoft. (2023, February 22). Manage mail flow rules in Exchange Online. Retrieved March 13, 2023. ↩
-
Microsoft. (n.d.). Get-InboxRule. Retrieved June 10, 2021. ↩
-
Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018. ↩