Analytics BIOC
Informational
✕
Exchange email-hiding transport rule
A user configured an Exchange transport rule that may be used to hide emails in the organization.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security
- Licensed by:
- Identity Threat Detection (ITDR)
- Licensed by:
- Email Security
- Data source:
- Office 365 Audit
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Hide Artifacts: Email Hiding Rules (T1564.008)
Attacker's goals:
Prevent an organization from warning users that they've been compromised (e.g. an internal spear-phishing campaign).
Investigative actions:
Look for signs that the user account and mailbox are compromised (e.g. abnormal logins, unusual activity). Check if the rule contains keywords and if they look suspicious. Investigate the IP address associated with the rule. Follow further actions done by the account. Check for a possible phishing campaign on the organization.* Look for multiple instances of email hiding, which may be an indication of a larger campaign.* Check if the user regularly configures transport rules.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- Suspicious Exchange email-hiding transport rule Medium (parent: Informational)
- Exchange email-hiding transport rule based on message keywords Low (parent: Informational)