T1564.008 — Email Hiding Rules

Tactic: Stealth · Platforms: Windows, Linux, macOS, Office Suite

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (4)

T1564.008 Hide Artifacts: Email Hiding Rules

title: "T1564.008 Hide Artifacts: Email Hiding Rules"
id: 7fc4d224-3f5c-4a20-9cae-8a2e44faad77
description: 'Detection Strategy for Email Hiding Rules via PowerShell New-InboxRule/Set-InboxRule (and related Remove/Enable/Disable-InboxRule) cmdlets captured in PowerShell Script Block Logging. (Data Component: Command Execution; baseline tier: windows-eventid.) Tune using: SuspiciousKeywords, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1564/008
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.stealth
  - attack.t1564.008

logsource:
  product: windows
  service: powershell

detection:
  selection:
    EventID: 4104
    ScriptBlockText|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
      - 'Remove-InboxRule'
      - 'Enable-InboxRule'
      - 'Disable-InboxRule'

  condition: selection

falsepositives:
  - Legitimate mailbox administration or help-desk/migration scripts creating or modifying inbox rules via PowerShell; tune with SuspiciousKeywords (rule actions targeting security-alert senders) and UserContext (admin vs standard user).

level: medium

T1564.008 Hide Artifacts: Email Hiding Rules

title: "T1564.008 Hide Artifacts: Email Hiding Rules"
id: 6e761c0e-bca2-4fd5-bb91-9d1b5eb41df3
description: 'Detects creation or modification of local mail-filtering rule files (procmail, .forward, Dovecot/managesieve Sieve scripts) via auditd PATH records, the closest Linux-observable proxy for T1564.008 email hiding rules. Auditd cannot see the semantic content of the rule (i.e. whether it specifically hides security alerts or C2 traffic) or true Exchange/PowerShell New-InboxRule activity, which is Windows/cloud-mail specific; this rule only flags that a rule-definition file was written, not its intent. Tune using: MailServerLogs.'
references:
  - https://attack.mitre.org/techniques/T1564/008
author: Shahrukh Khan
date: 2026-02-22
license: MIT
tags:
  - attack.stealth
  - attack.t1564.008

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|endswith:
      - '.procmailrc'
      - '.forward'
      - '.sieve'
      - 'dovecot.sieve'

  condition: selection

falsepositives:
  - Mail administrators and users routinely create or edit procmail/.forward/Sieve filter files for legitimate mail organization; auditd cannot distinguish benign filtering from rules crafted to hide malicious activity.

level: medium

T1564.008 Hide Artifacts: Email Hiding Rules

title: "T1564.008 Hide Artifacts: Email Hiding Rules"
id: d37adb33-70ae-4164-b6e7-06416aff983d
description: 'Detection Strategy for Email Hiding Rules. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedPlistFiles.'
references:
  - https://attack.mitre.org/techniques/T1564/008
author: Shahrukh Khan
date: 2026-05-27
license: MIT
tags:
  - attack.stealth
  - attack.t1564.008

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/defaults'
    CommandLine|contains: 'com.apple.mail'

  condition: selection

falsepositives:
  - Mail.app preference changes made by the user through System Settings rather than the command line, which this rule would miss, and legitimate defaults writes done by MDM mail profile deployment.

level: medium

T1564.008 Hide Artifacts: Email Hiding Rules

title: "T1564.008 Hide Artifacts: Email Hiding Rules"
id: c0c18469-ae9d-493a-93b9-ab8d871e9974
description: 'Detection Strategy for Email Hiding Rules. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: RuleScope.'
references:
  - https://attack.mitre.org/techniques/T1564/008
author: Shahrukh Khan
date: 2026-04-08
license: MIT
tags:
  - attack.stealth
  - attack.t1564.008

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
    Parameters.Name: 'DeleteMessage'
    Parameters.Value: 'True'

  condition: selection

falsepositives:
  - Users creating legitimate inbox rules that auto-delete newsletters or automated notification email.

level: high

Related sub-techniques

Explore