T1564.008Email Hiding Rules
T1564.008 — Email Hiding Rules is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 6 detection use cases covering it and 3 threat-intel articles citing it.
Defense Evasion
6Use cases
3Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1564 · Hide Artifacts
Use cases covering this technique (6)
O365 BEC Email Hiding Rule Created O365 Email New Inbox Rule Created O365 Email Transport Rule Changed [LLM] Post-compromise malicious inbox rule for defense evasion (UAT-11764 / ARToken BEC) [LLM] ARToken BEC toolkit: inbox forwarding/hiding rule creation on compromised M365 mailbox [LLM] Post-device-code malicious inbox rule creation (BEC prep)Articles citing this technique (3)
high Catan and Mouse art-261