General

This alarm is triggered when a new transport rule with a suspicious keyword is created within the organization's Exchange Online configuration. Such rules are intended to automatically perform an action on certain emails, and in this case, the rule triggers on words that potentially indicate misuse or hacking.

Rationale

When an attacker has gained access to an administrator account with rights on Exchange Online, they can use transport rules to remain undetected. This is a commonly used tactic in CEO fraud or BEC attacks.

For instance, emails with certain keywords, such as security alarms or responses to phishing emails, can be deleted or moved to a less conspicuous folder (see also: ATT&CK T1564.008).

Therefore, transport rules that trigger on certain keywords are potentially suspicious and can very well be the first signal that an attacker has gained access. Such rules should be investigated to determine whether there is misuse or hacking.

Follow-up

Perform these steps to adequately follow up on this detection:

1. Contact the administrator to validate whether the transport rule was created intentionally.
   
   
   1. If not: consider the administrator account as compromised:
      1. Reset the employee's password
      2. Revoke all logged-in sessions of the employee
      3. Remove the mailbox rule
      4. Consider conducting an Attic Tier2 investigation to learn more about the attack (who, what, when, where, why, how?). This is strongly advised since the executing user has administrative rights.
   2. If yes: assess whether the purpose of the transport rule conflicts with company policy.
      1. If yes: remove the transport rule and explain to the employee(s)
      2. If no: close the Attic incident as resolved

More Information

1. https://zolder.io/detecting-bec-fraud-using-azure-sentinel/