M365 Exchange Inbox Rule with Obfuscated Name

  1[metadata]
  2creation_date = "2026/05/27"
  3integration = ["o365"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies when a Microsoft Exchange inbox rule is created or modified with a name composed only of special characters.
 11Adversaries may use obfuscated inbox rule names to evade detection, hide malicious forwarding or deletion rules, or blend
 12in with benign audit noise. The rule name is parsed from "o365.audit.ObjectId", which encodes the mailbox identity and
 13rule name separated by a backslash.
 14"""
 15false_positives = [
 16    """
 17    Rare legitimate automation or third-party tools may create inbox rules with non-alphanumeric names. Validate against
 18    known messaging workflows and approved admin scripts before escalating.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "M365 Exchange Inbox Rule with Obfuscated Name"
 25note = """## Triage and analysis
 26
 27### Investigating M365 Exchange Inbox Rule with Obfuscated Name
 28
 29This rule flags `New-InboxRule` and `Set-InboxRule` activity where the inbox rule name extracted from
 30`o365.audit.ObjectId` contains only special characters. Attackers use these names to make malicious rules harder to spot
 31in the Microsoft 365 compliance portal and security tooling.
 32
 33Because this rule uses ESQL `grok` and `keep`, review the original `o365.audit` documents for full rule parameters
 34(`o365.audit.Parameters.*`) such as forwarding, deletion, or move actions.
 35
 36### Possible investigation steps
 37
 38- Review `Esql.inbox_rule_name` and `o365.audit.ObjectId` to confirm the parsed rule identity and mailbox path.
 39- Identify the actor using `o365.audit.UserId` and correlate with Entra ID sign-in logs for the same `source.ip`.
 40- Inspect `event.action` to determine whether the rule was newly created or modified.
 41- Review kept forwarding and redirect parameters (`ForwardTo`, `ForwardAsAttachmentTo`, `ForwardingAddress`,
 42   `RedirectTo`, `RedirectToRecipients`) for external destinations outside `user.domain`.
 43- Pull the source event and review `o365.audit.Parameters` for `DeleteMessage`, `MoveToFolder`, or
 44  `SubjectContainsWords` that indicate evasion or exfiltration intent.
 45- Hunt for other inbox rules from the same user or IP with standard or obfuscated names.
 46
 47### False positive analysis
 48
 49- Internal scripts that programmatically name rules with symbols may match. Document approved senders and exclude if
 50  necessary.
 51- Broken or partial `ObjectId` values can affect grok extraction; verify the parsed name in the raw audit record.
 52
 53### Response and remediation
 54
 55- Remove the inbox rule from the affected mailbox if unauthorized.
 56- Reset credentials and revoke sessions for the user if compromise is suspected.
 57- Review the tenant for additional malicious inbox or transport rules from the same source IP.
 58"""
 59references = ["https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/"]
 60risk_score = 47
 61rule_id = "1c3d9346-4591-4894-935c-dad2824850f2"
 62severity = "medium"
 63tags = [
 64    "Domain: Cloud",
 65    "Domain: SaaS",
 66    "Domain: Email",
 67    "Data Source: Microsoft 365",
 68    "Data Source: Microsoft 365 Audit Logs",
 69    "Use Case: Threat Detection",
 70    "Tactic: Defense Evasion",
 71    "Resources: Investigation Guide",
 72    "Noise: Unknown",
 73    "Performance: Normal",
 74    "Rule Type: ES|QL",
 75    "Platform: Microsoft 365",
 76    "Service: Microsoft Exchange Online",
 77]
 78timestamp_override = "event.ingested"
 79type = "esql"
 80
 81query = '''
 82from logs-o365.audit-* metadata _id, _version, _index
 83| where
 84    data_stream.dataset == "o365.audit" and
 85    event.provider == "Exchange" and
 86    event.action in ("New-InboxRule", "Set-InboxRule") and
 87    event.outcome == "success" and
 88    o365.audit.ObjectId is not null
 89| grok o365.audit.ObjectId """.*\\\\(?<Esql.inbox_rule_name>.*)$"""
 90// only special chars in inbox rule name
 91| where Esql.inbox_rule_name rlike """[!@#$%^&*()_+={[\]|\\:;"'<,>.?/~` \-]+"""
 92| keep
 93    @timestamp,
 94    _id,
 95    _version,
 96    _index,
 97    Esql.inbox_rule_name,
 98    o365.audit.ObjectId,
 99    o365.audit.UserId,
100    o365.audit.ApplicationId,
101    user.name,
102    user.domain,
103    event.action,
104    source.ip,
105    source.as.number,
106    source.as.organization.name,
107    o365.audit.Parameters.ForwardTo,
108    o365.audit.Parameters.ForwardAsAttachmentTo,
109    o365.audit.Parameters.RedirectTo
110'''
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "Esql.inbox_rule_name",
116    "o365.audit.ObjectId",
117    "o365.audit.UserId",
118    "user.name",
119    "user.domain",
120    "event.action",
121    "source.ip",
122    "source.as.organization.name",
123    "o365.audit.Parameters.ForwardTo",
124    "o365.audit.Parameters.ForwardAsAttachmentTo",
125    "o365.audit.Parameters.RedirectTo"
126]
127
128[[rule.threat]]
129framework = "MITRE ATT&CK"
130
131[[rule.threat.technique]]
132id = "T1564"
133name = "Hide Artifacts"
134reference = "https://attack.mitre.org/techniques/T1564/"
135
136[[rule.threat.technique.subtechnique]]
137id = "T1564.008"
138name = "Email Hiding Rules"
139reference = "https://attack.mitre.org/techniques/T1564/008/"
140
141[rule.threat.tactic]
142id = "TA0005"
143name = "Defense Evasion"
144reference = "https://attack.mitre.org/tactics/TA0005/"
145
146[[rule.threat]]
147framework = "MITRE ATT&CK"
148
149[[rule.threat.technique]]
150id = "T1137"
151name = "Office Application Startup"
152reference = "https://attack.mitre.org/techniques/T1137/"
153
154[[rule.threat.technique.subtechnique]]
155id = "T1137.005"
156name = "Outlook Rules"
157reference = "https://attack.mitre.org/techniques/T1137/005/"
158
159[rule.threat.tactic]
160id = "TA0003"
161name = "Persistence"
162reference = "https://attack.mitre.org/tactics/TA0003/"