Thread by @jhencinski

BEC threat actors favorite #M365 Inbox-rule names:

'.'
'..'
'.;'
'l'
'r'

By deleting specific emails, an attacker can reduce the chance of the victim spotting unusual activity.

You can build high quality detections to spot this activity. A 🧵with real-world examples...

Account takeover (ATO) activity in M365 can involve various unauthorized actions performed by an attacker who has gained control over the account.

Of the ATO activity we identified in M365 in Q1 '23:

50% of all ATO in M365 we identified was for New-inbox rules created by the attacker to automatically delete or hide certain emails from the compromised account.

By deleting specific emails, an attacker can reduce the chance of the victim or email administrators spotting unusual activity.

Of the New-Inbox rules created by an attacker in M365 in Q1 '23, 54% were named “.”, 18% were named “..” and 16% were named with a single alpha character.

The most common Inbox-rules actions setup by attackers? To automatically delete specific emails or mark certain emails as “read” and then automatically move them to the “Archive” and “RSS Subscriptions” folders.

OK, here are some real-world examples:

Rule name: "."
Applied to: This rule will be applied to emails that have the words, `Payroll on hold`, in the subject or body.
Action: Emails matching this rule will be moved to the `Archive` folder. The emails will be marked as read.

Here's another one:

Rule name: "l"
Applied to: This rule will be applied to emails that have the words, `proposal;hack;phish;password;compromise`, in the subject or body.
Action: Emails matching this rule moved to the `RSS Subscriptions` folder. Emails will be marked as read.

Rule name: ".."
Applied to: This rule will be applied to emails that have the words, ;blocko;hacked;phishing;malicious;suspicious`, in the subject or body.
Action: The emails will be marked as read. Any emails meeting this rule will be deleted.

This @ExpelSecurity blog we wrote back in 2019 has more details, M365 log examples, and guidance on how to think about detecting this activity. It's worth a read if you're struggling to wrap your arms around BEC/account compromise/ATO.

expel.com/blog/seven-way…