Detection: O365 BEC Email Hiding Rule Created

Updated Date: 2025-02-14 ID: 603ebac2-f157-4df7-a6ac-34e8d0350f86 Author: 0xC0FFEEEE, Github Community Type: TTP Product: Splunk Enterprise Security

Description

This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account.

 1`o365_management_activity` Workload=Exchange Operation="New-InboxRule" 
 2| stats values(Name) as Name, values(MarkAsRead) as MarkAsRead, values(MoveToFolder) as MoveToFolder by _time Id user 
 3| lookup ut_shannon_lookup word as Name 
 4| eval entropy_score=if(ut_shannon<=2, 1, 0) 
 5| eval len_score=if(len(Name)<=3, 1,0) 
 6| eval read_score=if(MarkAsRead="True", 1, 0) 
 7| eval folder_score=if(match(MoveToFolder, "^(RSS
 8|Conversation History
 9|Archive)"), 1, 0) 
10| eval suspicious_score=entropy_score+len_score+read_score+folder_score 
11| where suspicious_score>2 
12| `o365_bec_email_hiding_rule_created_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name Value
o365_management_activity sourcetype=o365:management:activity
o365_bec_email_hiding_rule_created_filter search *
o365_bec_email_hiding_rule_created_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1564.008 Email Hiding Rules Defense Evasion
Exploitation
DE.CM
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed.

Known False Positives

Short rule names may trigger false positives. Adjust the entropy and length thresholds as needed.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Potential BEC mailbox rule was created by $user$

Risk Object Risk Object Type Risk Score Threat Objects
user user 25 Name

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset o365 o365:management:activity
Integration ✅ Passing Dataset o365 o365:management:activity

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1