PowerShell inbox rule created or modified to delete, move or hide mail

Siemphony@siemphonylowT1564.008unverified

Matches AN0551's Windows leg: a PowerShell script block (EventID 4104) that both names the cmdlet MITRE's analytic calls out (`New-InboxRule` or `Set-InboxRule`) and sets one of the parameters that makes the rule actually hide mail rather than merely file it. AN0551's own description names the three verbs this technique performs against a mailbox — delete, move, hide — and `-DeleteMessage`, `-SoftDeleteMessage`, `-MoveToFolder`, `-StopProcessingRules` and `-MarkAsRead` are the real parameters of those two cmdlets that do each; that mapping is authored here from the cmdlets' own parameter set, not supplied by MITRE. MITRE's SuspiciousKeywords knob (terms like "phish" or "malware" inside a rule's own filter condition, e.g. `-SubjectContainsWords`) is a narrower, distinct signal this rule does not gate on, since an adversary hiding a security alert has no reason to name it in the rule that hides it; the UserContext knob (scope to high-value mailboxes) is a deployment-time filter this rule cannot express without a concrete username list. The macOS leg AN0552 (plist file edits under `macos:unifiedlog`) is not attempted: that log source has no standardised Sigma field vocabulary anywhere in this corpus, the same blocker already recorded for it elsewhere. The Linux leg AN0553 (execve of mail clients or sieve editors touching a filter config file) is not attempted either — it reduces to a text editor being launched with a filename argument, which is indistinguishable from routine maintenance of that same file and carries no evidence of what the edit actually did, unlike the PowerShell leg where the cmdlet parameters state the effect directly. This rule also only sees rule changes made through PowerShell, including calls made through the proxy functions a `Connect-ExchangeOnline` session generates locally; a rule created through the Outlook client UI, the Exchange admin centre, or the Graph API leaves no local script block and is invisible here — AN0551 itself is scoped to the PowerShell path only, and this brief offers no Office Suite or web-based alternative log source to cover the rest. EventID 4104 requires the *Turn on PowerShell Script Block Logging* policy, which is off in a default install and in the MS and CIS baselines; without it this rule returns zero rows because the host is blind, not because nothing happened. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0192, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "New-InboxRule" or ScriptBlockText contains "Set-InboxRule")) and (ScriptBlockText contains "-DeleteMessage" or ScriptBlockText contains "-SoftDeleteMessage" or ScriptBlockText contains "-MoveToFolder" or ScriptBlockText contains "-StopProcessingRules" or ScriptBlockText contains "-MarkAsRead"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*New-InboxRule*" OR ScriptBlockText="*Set-InboxRule*")) AND (ScriptBlockText="*-DeleteMessage*" OR ScriptBlockText="*-SoftDeleteMessage*" OR ScriptBlockText="*-MoveToFolder*" OR ScriptBlockText="*-StopProcessingRules*" OR ScriptBlockText="*-MarkAsRead*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*new-inboxrule*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*set-inboxrule*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*-deletemessage*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-softdeletemessage*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-movetofolder*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-stopprocessingrules*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-markasread*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(New-InboxRule|Set-InboxRule)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(-DeleteMessage|-SoftDeleteMessage|-MoveToFolder|-StopProcessingRules|-MarkAsRead)</field>    <description>PowerShell inbox rule created or modified to delete, move or hide mail</description>    <mitre>      <id>T1564.008</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: hide_artifacts
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: da019de0-057a-409d-8489-3cbb86353723

ATT&CKT1564.008

T1564.008Email Hiding Rules

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

This rule catches one specific path to hiding mail: an administrator or attacker running PowerShell against Exchange to create or modify an inbox rule that deletes, moves, or hides messages before a user sees them. It is built from AN0551's Windows leg only — the part of the analytic covering the New-InboxRule/Set-InboxRule cmdlets, run locally or through the proxy functions a Connect-ExchangeOnline session generates.

02 · Telemetry you need

Windows PowerShell EventID 4104 — full script block text. This requires Turn on PowerShell Script Block Logging to be enabled; it is off by default and off in the MS and CIS baselines. Without it, this rule returns zero rows because the host is blind, not because nothing happened.

03 · How the logic works

Three selections, ANDed together. selection_event gates on EventID: 4104. selection_cmdlet requires ScriptBlockText to contain New-InboxRule or Set-InboxRule — the cmdlets AN0551 names. selection_hiding_action requires the same script block to also contain one of five parameters: -DeleteMessage, -SoftDeleteMessage, -MoveToFolder, -StopProcessingRules, or -MarkAsRead. That parameter list is not from MITRE — it is authored here, mapped from the two cmdlets' own parameter sets against the three verbs AN0551's description names for this technique (delete, move, hide). The rule deliberately does not gate on MITRE's SuspiciousKeywords knob (terms like "phish" inside a rule's own filter condition): an attacker hiding a security alert has no reason to name it in the rule doing the hiding, so that signal is narrower and largely self-defeating here. It also skips MITRE's UserContext knob (scoping to high-value mailboxes), since that requires a concrete username list this rule cannot express without deployment-specific input. Two of AN0551's three legs are not attempted at all. The macOS leg AN0552 reads plist edits from macos:unifiedlog, which has no standardised Sigma field vocabulary anywhere in this corpus. The Linux leg AN0553 watches execve of mail clients or sieve editors touching a filter config file — but that reduces to a text editor opened with a filename, indistinguishable from routine maintenance and carrying no evidence of what the edit did, unlike the PowerShell leg where the cmdlet parameters state the effect directly.

04 · Common false positives

Every false positive here is legitimate Exchange administration that happens to share the exact cmdlet-plus-parameter shape this rule watches for, which is why level is set to low. Mailbox hygiene and migration scripts are the highest-volume source — any tenant that manages rules by script runs New-InboxRule/Set-InboxRule -MoveToFolder constantly for routine filing. Retention, DLP, and anti-spam automation provisions rules with -DeleteMessage or -StopProcessingRules across many mailboxes on a schedule. Helpdesk tooling running under a shared service account applies user-requested filing rules at volume. Most notably, the security team's own incident-response scripts that quarantine a confirmed phishing campaign with -MoveToFolder or -MarkAsRead are structurally identical to the technique this rule is meant to catch.

05 · Detection maturity

tier_1: This rule has never been run against a log line and sits at the lowest DeBMM tier — authored, not validated — until someone executes it against real EventID 4104 data with script block logging enabled and confirms both that it fires on the intended cmdlet pattern and that the false-positive list above holds in a real environment.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Start by excluding the service accounts and scheduled task identities behind known DLP, retention, and IR automation — SubjectUserName or the caller identity in the surrounding session is not modelled in this rule and would need to be added. Consider narrowing to interactive/ad-hoc sessions versus scheduled ones, and cross-reference against a change-management record for any rule touching a mailbox flagged as high-value. Note also that this rule only sees the PowerShell path — rules created through the Outlook client UI, the Exchange admin centre, or the Graph API leave no local script block and are invisible here, so absence of hits does not mean absence of hidden mail.

Declared by the author

Mailbox hygiene and migration scripts run by Exchange administrators, which are the highest-volume source of New-InboxRule and Set-InboxRule with -MoveToFolder in any tenant that manages rules by script — filing newsletters, notifications or out-of-office copies into a subfolder as routine housekeeping.
Retention, DLP and anti-spam automation that provisions mail-flow rules with -DeleteMessage or -StopProcessingRules across many mailboxes on a schedule as part of ordinary bulk-mail handling, not as concealment.
Helpdesk or self-service tooling that runs under a shared service account and applies a user-requested filing rule with -MoveToFolder or -MarkAsRead for many different mailboxes in a single working day.
The security or messaging team's own incident-response scripts, which create a rule with -MoveToFolder or -MarkAsRead to quarantine a confirmed phishing campaign — legitimate defensive automation that is structurally identical to the technique it is being used to contain.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.008, evaluated against their — events.

Share this rule

/u/siemphony/da019de0-057a-409d-8489-3cbb86353723

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell inbox rule created or modified to delete, move or hide mail

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it