Sunturai
Back to results
MediumSplunk security content0xC0FFEEEE +1

O365 BEC Email Hiding Rule Created

This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by…

Description

This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account.

Detection logic

Detection requirements

Platform
LinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

  • Short rule names may trigger false positives. Adjust the entropy and length thresholds as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice