AN1309
Analytic 1309
Windows
Correlates creation of email forwarding rules or header anomalies (e.g., X-MS-Exchange-Organization-AutoForwarded) with suspicious process execution, file access of .pst/.ost files, and network connections to external SMTP servers.
WinEventLog:Security
EventCode=5145
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Application
Exchange logs or header artifacts
WinEventLog:Sysmon
EventCode=3, 22
[TimeWindow]
Defines correlation window across email rule creation and outbound SMTP.
[UserContext]
Filters for admin or service accounts to reduce false positives.
[SMTPDomainList]
Allows tuning based on expected external email domains.
AN1310
Analytic 1310
Linux
Detects file access to mbox/maildir files in conjunction with curl/wget/postfix execution, or anomalous shell scripts harvesting user mail directories.
auditd:SYSCALL
open
linux:syslog
postfix/smtpd
linux:osquery
process_events
[WatchedMailDirs]
Specify user mail directories (/var/mail, ~/Maildir)
[ProcessNameList]
Tune based on local mail clients or curl usage in environment
[TimeWindow]
Define how close together access and exfil events must occur
AN1311
Analytic 1311
macOS
Monitors Mail.app database or maildir file access, automation via AppleScript, and abnormal mail rule creation using scripting or UI automation frameworks.
macos:unifiedlog
Mail or AppleScript subsystem
macos:endpointsecurity
es_event_open, es_event_exec
[ScriptProcessNameList]
Script interpreters or automation tools (osascript, Automator, etc.)
[WatchedMailFiles]
Mail.app SQLite DB or .emlx directory
AN1312
Analytic 1312
Office Suite
Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.
m365:unified
Set-Mailbox, New-InboxRule
m365:exchange
MessageTrace logs
azure:ad
SignInEvents
[UserAgentList]
Restrict rules from non-browser agents
[ExternalSMTPDomainList]
Allow listing for org-sanctioned forwarding domains
[TimeWindow]
Time delta between rule creation and suspicious sign-in