AN1589
Analytic 1589
Windows
Creation of inbox rules via PowerShell (New-InboxRule) or transport rules using Exchange cmdlets. Correlates user behavior, cmdlet usage, and rule properties.
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Security
EventCode=4688
m365:exchange
Cmdlet - New-InboxRule
[UserContext]
Certain service accounts or admin contexts may be expected to run these rules.
[TimeWindow]
Correlate between rule creation and follow-on message forwarding within this timeframe.
[TargetMailbox]
Whitelisted or trusted destination addresses may be tuned per org policy.
AN1590
Analytic 1590
macOS
Creation or modification of Apple Mail rules by accessing plist files or GUI automation (AppleScript).
macos:unifiedlog
log stream --predicate
fs:plist_monitoring
/Users/*/Library/Mail/V*/MailData/RulesActiveState.plist
[RuleFilePath]
Different Mail versions store rules in slightly different locations.
[ScriptTrigger]
AppleScript usage for GUI automation may be common in automation workflows.
AN1591
Analytic 1591
Office Suite
Creation of email forwarding/redirect rules in Exchange Online via New-InboxRule or transport rule cmdlets, including auto-forwarding address field usage.
m365:unified
New-InboxRule, Set-InboxRule
m365:messagetrace
X-MS-Exchange-Organization-AutoForwarded
[ForwardingSMTPAddress]
Destination domain may vary; commonly tuned per org policies.
[ActorId]
Differentiate service/admin users vs standard user population.
AN1592
Analytic 1592
Linux
Modification of Thunderbird message filters file or execution of CLI tools (e.g., formail/procmail) that alter .forward behavior.
auditd:SYSCALL
write
linux:cli
/home/*/.bash_history
[.forwardPath]
User-based home directories; tune for specific user patterns.
[ExecContext]
Expected email client behavior may trigger similar file edits.