---
title: Microsoft 365 Exchange inbox rule set up to hide email
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Microsoft 365 Exchange inbox rule set
  up to hide email
---

# Microsoft 365 Exchange inbox rule set up to hide email
Classification:attackTactic:[TA0005-defense-evasion](https://attack.mitre.org/tactics/TA0005)Technique:[T1564-hide-artifacts](https://attack.mitre.org/techniques/T1564) 
## Goal{% #goal %}

Detect when a user configures an inbox rule to move or delete email.

## Strategy{% #strategy %}

Monitor Microsoft 365 Exchange audit logs to look for the operation [`New-InboxRule`](https://learn.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps) or [`Set-InboxRule`](https://learn.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps). Attackers might set up email rules to hide incoming emails in a compromised user mailbox to hide their activities. They may delete emails or mark them as read and move emails to less noticeable folders like 'Conversation History'. In addition, the rule may be set up to look for keywords like 'hack', 'phishing' or 'invoice'.

## Triage and response{% #triage-and-response %}

1. Inspect the inbox rule for any indicators:
   - Suspicious keywords in the filter.
   - The rule name.
1. Determine if there is a legitimate use case for the inbox rule by contacting the user `{{@usr.email}}`.
1. If `{{@usr.email}}` is not aware of the inbox rule:
   - Investigate other activities performed by the user `{{@usr.email}}` using the Cloud SIEM - User Investigation dashboard.
   - Begin your organization's incident response process and investigate.

## Changelog{% #changelog %}

- 17 August 2023 - Updated query to replace attribute `@threat_intel.results.subcategory:tor` with `@threat_intel.results.category:tor`.
- 18 December 2025 - Removed corporate VPNs as a threat intel source.