Esc

Email Hiding Rules - T1564.008

(ATT&CK® Technique)

Definition

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule PowerShell cmdlets on Windows systems.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1564008["Email Hiding Rules"] --> |modifies| ApplicationConfiguration["Application Configuration"]; class T1564008 OffensiveTechniqueNode;
        class ApplicationConfiguration ArtifactNode; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration";
        click T1564008 href "/offensive-technique/attack/T1564.008/"; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration"; T1564008["Email Hiding Rules"] --> |may-create| EmailRule["Email Rule"]; class T1564008 OffensiveTechniqueNode;
        class EmailRule ArtifactNode; click EmailRule href "/dao/artifact/d3f:EmailRule";
        click T1564008 href "/offensive-technique/attack/T1564.008/"; click EmailRule href "/dao/artifact/d3f:EmailRule"; T1564008["Email Hiding Rules"] --> |may-modify| EmailRule["Email Rule"]; class T1564008 OffensiveTechniqueNode;
        class EmailRule ArtifactNode; click EmailRule href "/dao/artifact/d3f:EmailRule";
        click T1564008 href "/offensive-technique/attack/T1564.008/"; click EmailRule href "/dao/artifact/d3f:EmailRule";                                       RestoreConfiguration["Restore Configuration"] -->
          | restores | ApplicationConfiguration["Application Configuration"];

          RestoreConfiguration["Restore Configuration"] -.->
            | may-restore | T1564008["Email Hiding Rules"] ;
          class RestoreConfiguration DefensiveTechniqueNode;
          class ApplicationConfiguration ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration"; RestoreConfiguration["Restore Configuration"] -->
          | restores | EmailRule["Email Rule"];

          
          class RestoreConfiguration DefensiveTechniqueNode;
          class EmailRule ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration";  ApplicationConfigurationHardening["Application Configuration Hardening"] -->
          | hardens | ApplicationConfiguration["Application Configuration"];

          ApplicationConfigurationHardening["Application Configuration Hardening"] -.->
            | may-harden | T1564008["Email Hiding Rules"] ;
          class ApplicationConfigurationHardening DefensiveTechniqueNode;
          class ApplicationConfiguration ArtifactNode;
          click ApplicationConfigurationHardening href "/technique/d3f:ApplicationConfigurationHardening"; ApplicationConfigurationHardening["Application Configuration Hardening"] -->
          | hardens | EmailRule["Email Rule"];

          
          class ApplicationConfigurationHardening DefensiveTechniqueNode;
          class EmailRule ArtifactNode;
          click ApplicationConfigurationHardening href "/technique/d3f:ApplicationConfigurationHardening";

json