T1564.008sub-technique of T1564 Hide Artifacts

Email Hiding Rules

Windows · Linux · macOS · Office Suite2 pieces on this siteT1564.008 on attack.mitre.org

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the `New-InboxRule` or `Set-InboxRule` PowerShell cmdlets on Windows systems.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

IR playbookCONSTRUCTED

Business email compromise response plan: the money first, then the mailbox

Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.

T1564.008

Practise it

Labs, timelines, evidence packs and tabletop scenarios to work before you need to.

TabletopCONSTRUCTED

Impossible travel, and then a mailbox rule

You have fifteen minutes. What are your first three queries, in order, and what single action do you take before any of them? Write down what you expect each query to return before you run it.

T1564.008

how MITRE says to see it

Detection Strategy for Email Hiding Rules

Suspicious creation or modification of inbox rules through PowerShell (New-InboxRule, Set-InboxRule) to automatically delete, move, or hide emails. Defender perspective: unusual rule activity correlated with mailbox access and filtering patterns.
Alterations to plist configuration files (RulesActiveState.plist, SyncedRules.plist, UnsyncedRules.plist, MessageRules.plist) that define email hiding or filtering rules. Defender perspective: unexpected changes in these files associated with Mail.app processes.
Rule manipulation through local email clients (e.g., Evolution, Thunderbird) or server-side filtering scripts (e.g., sieve) creating conditions to move or discard emails with security-related keywords.
Suspicious rule creation within Outlook or Exchange clients, including auto-move or delete conditions tied to incident or security alert keywords. Defender perspective: correlation between missing inbound emails and newly added mailbox rules.

what reduces it

M1047 Audit. Enterprise email solutions may have monitoring mechanisms that may include the ability to audit inbox rules on a regular basis. In an Exchange environment, Administrators can use `Get-InboxRule` / `Remove-InboxRule` and `Get-TransportRule` / `Remove-TransportRule` to discover and remove potentially malicious inbox and transport rules.

the rest of T1564

T1564.001 Hidden Files and Directories · not covered yet
T1564.002 Hidden Users · not covered yet
T1564.003 Hidden Window · not covered yet
T1564.004 NTFS File Attributes · not covered yet
T1564.005 Hidden File System · not covered yet
T1564.006 Run Virtual Instance · not covered yet
T1564.007 VBA Stomping · not covered yet
T1564.009 Resource Forking · not covered yet
T1564.010 Process Argument Spoofing · not covered yet
T1564.011 Ignore Process Interrupts · not covered yet
T1564.012 File/Path Exclusions · not covered yet
T1564.013 Bind Mounts · not covered yet
T1564.014 Extended Attributes · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.