AN0737
Analytic 0737
Windows
Detects mailbox manipulation or deletion via PowerShell (e.g., Remove-MailboxExportRequest), file deletion from Outlook data stores (Unistore.db), or tampering with quarantined mail logs.
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=23
WinEventLog:Security
EventCode=4663, 4670, 4656
m365:exchange
Transport Rule Modification
[MailstorePath]
Outlook files in AppData\Local\Comms\Unistore\data
[TransportRuleNames]
Target suspicious rule changes (e.g., header removal)
[PowerShellCommandMatch]
Regex match on `Remove-MailboxExportRequest` and similar Exchange cmdlets
AN0738
Analytic 0738
Linux
Detects the use of mail utilities like `mail` or `mailx` to delete mailbox content, or file-level deletion of inbox files from `/var/spool/mail/` or `/var/mail/` following suspicious sessions.
auditd:SYSCALL
execve
auditd:SYSCALL
unlink/unlinkat
[MailFolderPath]
Common inbox file locations like /var/spool/mail/, /var/mail/
[CommandPattern]
Usage of mailx or echo piped to mail followed by deletion
AN0739
Analytic 0739
macOS
Detects removal of Apple Mail artifacts via AppleScript or direct deletion of mailbox content in ~/Library/Mail/, especially when preceded by Remote Login or C2-related API access.
macos:unifiedlog
log stream
macos:osquery
file_events
[ScriptCommandMatch]
AppleScript references to Mail.app and delete commands
[LibraryPathMatch]
Files within ~/Library/Mail/V*/ folders
AN0740
Analytic 0740
Office Suite
Detects Exchange Online or on-prem transport rule changes (e.g., header stripping) and mailbox export cleanup via `Remove-MailboxExportRequest`, as well as admin actions via Exchange PowerShell sessions.
m365:exchange
Admin Audit Logs, Transport Rules
WinEventLog:PowerShell
Exchange Cmdlets
[CmdletFilter]
Include `New-TransportRule`, `Set-TransportRule`, `Remove-*` actions
[UserRoleScope]
Track role assignments for admins performing deletions