General

This alarm is triggered when a new mailbox rule with a suspicious keyword is created within the organization. Such rules are used to automatically perform an action on certain emails, and in this case, the rule triggers on words that potentially indicate misuse or hacking.

Rationale

When an attacker has gained access to a mailbox, they can use email rules to remain unnoticed. This is a commonly used tactic in CEO fraud or BEC attacks.

For example, emails with certain keywords, such as security alarms or responses to phishing emails, can be deleted or moved to a less conspicuous folder (see also: ATT&CK T1564.008).

Therefore, mailbox rules that trigger on certain keywords are potentially suspicious and can very well be the first signal that an attacker has gained access. Such rules should be investigated to determine if there is any misuse or hacking.

Follow-up

Follow these steps to adequately respond to this detection:

1. Contact the employee to validate whether the mailbox rule was intentionally created.
   
   
   1. If not: consider the employee account as compromised:
      1. Reset the employee's password
      2. Revoke all logged-in sessions of the employee
      3. Remove the mailbox rule
      4. Consider conducting an Attic Tier2 investigation to learn more about the attack (who, what, when, where, why, how?)
   2. If yes: assess whether the purpose of the mailbox rule conflicts with company policy.
      1. If yes: remove the forwarding rule and provide an explanation to the employee(s)
      2. If no: close the Attic incident as resolved

More Information

1. https://zolder.io/detecting-bec-fraud-using-azure-sentinel/