T1564.008 Email Hiding Rules

> Sub-technique of: T1564

High-Level Description

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the <code>New-InboxRule</code> or <code>Set-InboxRule</code> PowerShell cmdlets on Windows systems.

Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to Internal Spearphishing emails sent from the compromised account.

Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as <code>malware</code>, <code>suspicious</code>, <code>phish</code>, and <code>hack</code>) found in message bodies and subject lines.

In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions. Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows, Linux, macOS, Office Suite

What to Check

• ] Identify if Email Hiding Rules technique is applicable to target environment
• ] Check Windows systems for indicators of Email Hiding Rules
• ] Check Linux systems for indicators of Email Hiding Rules
• ] Check macOS systems for indicators of Email Hiding Rules
• ] Verify mitigations are bypassed or absent (1 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Email Hiding Rules by examining the target platforms (Windows, Linux, macOS).

1. Assess Existing Defenses: Review whether mitigations for T1564.008 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1047 Audit

Enterprise email solutions may have monitoring mechanisms that may include the ability to audit inbox rules on a regular basis.

In an Exchange environment, Administrators can use Get-InboxRule / Remove-InboxRule and Get-TransportRule / Remove-TransportRule to discover and remove potentially malicious inbox and transport rules.

Detection

Detection Strategy for Email Hiding Rules

Risk Assessment

| Finding | Severity | Impact | | --------------------------------------- | -------- | --------------- | | Email Hiding Rules technique applicable | High | Defense Evasion |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------- | | CWE-693 | Protection Mechanism Failure |

References

• MacOS Email Rules
• Microsoft BEC Campaign
• Microsoft Mail Flow Rules 2023
• Microsoft Inbox Rules
• Microsoft New-InboxRule
• Microsoft Set-InboxRule
• Microsoft Cloud App Security
• Atomic Red Team - T1564.008
• MITRE ATT&CK - T1564.008