Creation of inbox rules via PowerShell (New-InboxRule) or transport rules using Exchange cmdlets. Correlates user behavior, cmdlet usage, and rule properties.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | WinEventLog:PowerShell | EventCode=4104 |
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| Cloud Service Metadata (DC0070) | m365:exchange | Cmdlet - New-InboxRule |
| Field | Description |
|---|---|
| UserContext | Certain service accounts or admin contexts may be expected to run these rules. |
| TimeWindow | Correlate between rule creation and follow-on message forwarding within this timeframe. |
| TargetMailbox | Whitelisted or trusted destination addresses may be tuned per org policy. |
Creation or modification of Apple Mail rules by accessing plist files or GUI automation (AppleScript).
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | macos:unifiedlog | log stream --predicate |
| File Modification (DC0061) | fs:plist_monitoring | /Users/*/Library/Mail/V*/MailData/RulesActiveState.plist |
| Field | Description |
|---|---|
| RuleFilePath | Different Mail versions store rules in slightly different locations. |
| ScriptTrigger | AppleScript usage for GUI automation may be common in automation workflows. |
Creation of email forwarding/redirect rules in Exchange Online via New-InboxRule or transport rule cmdlets, including auto-forwarding address field usage.
| Data Component | Name | Channel |
|---|---|---|
| Cloud Service Metadata (DC0070) | m365:unified | New-InboxRule, Set-InboxRule |
| Application Log Content (DC0038) | m365:messagetrace | X-MS-Exchange-Organization-AutoForwarded |
| Field | Description |
|---|---|
| ForwardingSMTPAddress | Destination domain may vary; commonly tuned per org policies. |
| ActorId | Differentiate service/admin users vs standard user population. |
Modification of Thunderbird message filters file or execution of CLI tools (e.g., formail/procmail) that alter .forward behavior.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL | write |
| Command Execution (DC0064) | linux:cli | /home/*/.bash_history |
| Field | Description |
|---|---|
| .forwardPath | User-based home directories; tune for specific user patterns. |
| ExecContext | Expected email client behavior may trigger similar file edits. |