Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1564.008

T1564.008Email Hiding Rules

T1564.008 — Email Hiding Rules is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 6 detection use cases covering it and 3 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
6Use cases
3Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1564 · Hide Artifacts

Use cases covering this technique (6)

O365 BEC Email Hiding Rule Created ESCU actions · alerting P O365 Email New Inbox Rule Created ESCU actions · hunting P O365 Email Transport Rule Changed ESCU actions · hunting P [LLM] Email-hiding inbox rules created post-compromise (BEC / mailbox concealment) Bespoke actions · hunting DSΣP [LLM] Post-compromise M365 defense-evasion inbox rule creation (UAT-11764 mailbox takeover) Bespoke actions · hunting DSΣ [LLM] Post-device-code malicious inbox rule creation (BEC prep) Bespoke actions · alerting DSP

Articles citing this technique (3)

crit You were onto something with “It’s the Climb,” Miley art-165
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
high EvilTokens: A phishing attack that doesn’t steal your password art-377