Jewelbug APT Breaches Government Webmail: Detection and Hardening Guide for Email Infrastructure

---
title: Suspicious Inbox Rule Creation or Forwarding on Mail Server
description: Detects creation of inbox forwarding or deletion rules indicative of mailbox-based exfiltration, consistent with Jewelbug-style webmail compromise. Fires on Exchange/OWA rule manipulation via PowerShell remoting or EWS.
references:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://attack.mitre.org/techniques/T1098/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.collection
  - attack.t1114.002
  - attack.persistence
logsource:
  product: windows
  category: process_creation
detection:
  selection_cmdlets:
    CommandLine|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
      - 'Enable-InboxRule'
  selection_actions:
    CommandLine|contains:
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
      - 'DeleteMessage'
  condition: selection_cmdlets and selection_actions
falsepositives:
  - Legitimate helpdesk mailbox administration; correlate with change tickets and admin account baselines
level: high
---
title: SAM or System Hive Dump on Mail or Web Server
description: Detects credential theft via registry hive export (reg save of SAM/SYSTEM/SECURITY) on servers hosting webmail or web applications, a technique used to extract local credentials for persistence and lateral movement.
references:
  - https://attack.mitre.org/techniques/T1003/002/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.credential_access
  - attack.t1003.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith: '\reg.exe'
  selection_cli:
    CommandLine|contains:
      - ' save '
      - ' export '
  selection_hives:
    CommandLine|contains:
      - 'HKLM\SAM'
      - 'HKLM\SYSTEM'
      - 'HKLM\SECURITY'
      - 'hkey_local_machine\sam'
      - 'hkey_local_machine\system'
      - 'hkey_local_machine\security'
  condition: selection_img and selection_cli and selection_hives
falsepositives:
  - Rare legitimate backup or migration activity; validate against authorized admin windows
level: critical
---
title: Tunneling or Reverse Proxy Tool Execution on Server
description: Detects execution of common tunneling/ingress tools (cloudflared, ngrok, chisel, frpc, ligolo) frequently abused by APT actors including Jewelbug for covert C2 channels that blend into outbound HTTPS.
references:
  - https://attack.mitre.org/techniques/T1572/
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1090
logsource:
  category: process_creation
detection:
  selection_name:
    Image|endswith:
      - '\cloudflared.exe'
      - '\ngrok.exe'
      - '\chisel.exe'
      - '\frpc.exe'
      - '\ligolo-agent.exe'
      - '\ligolo-ng.exe'
      - '/cloudflared'
      - '/ngrok'
      - '/chisel'
      - '/frpc'
  selection_cli:
    CommandLine|contains:
      - ' tunnel '
      - 'trycloudflare.com'
      - ' --url '
      - 'socks'
      - 'reverse'
  condition: selection_name or selection_cli
falsepositives:
  - Legitimate developer or DevOps tunneling; maintain an approved-tools inventory and alert on deviation
level: high

// Hunt 1: Suspicious inbox rule creation and mailbox forwarding (Exchange Online / O365 audit)
OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation in ("New-InboxRule", "Set-InboxRule", "Set-Mailbox", "Add-MailboxPermission")
| extend Parameters = tostring(OfficeObjectId)
| extend Params = parse_json(tostring(parse_json(RecordType)))
| mv-expand parse_json(parse_json(tostring(ParametersParsed = "") ))  // placeholder-safe: use raw JSON below
| extend RawParams = tostring(parse_json(tostring("")))
| project TimeGenerated, UserId, ClientIP, Operation, OfficeObjectId, ResultStatus
| where ResultStatus =~ "Success"
| summarize RuleChanges = count(), Operations = make_set(Operation), SourceIPs = make_set(ClientIP) by UserId, bin(TimeGenerated, 1d)
| where RuleChanges > 2
| order by TimeGenerated desc;

// Hunt 2: Non-standard client IPs accessing many distinct mailboxes (IMAP/OWA/EWS abuse)
OfficeActivity
| where TimeGenerated > ago(14d)
| where Operation in ("MailItemsAccessed", "UserLoggedIn", "MailboxLogin")
| summarize DistinctMailboxes = dcount(OfficeObjectId), IPs = make_set(ClientIP) by UserId, bin(TimeGenerated, 1h)
| where DistinctMailboxes > 10
| order by DistinctMailboxes desc;

// Hunt 3: Web server processes spawning shells or credential tools (Linux mail/web servers via Syslog)
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in ("reg", "cmd", "powershell", "pwsh", "bash", "sh", "openssl", "cloudflared", "ngrok", "chisel")
| where SyslogMessage has_any ("save HKLM", "shadow", "htpasswd", "tunnel", "reverse", "--url")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

-- Hunt: tunneling tools, credential dump artifacts, and anomalous connections on servers
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(tunnel|trycloudflare|reverse|socks|--url|reg save|save HKLM)'
   OR Exe =~ '(?i)(cloudflared|ngrok|chisel|frpc|ligolo)'

LET artifacts = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Windows/Temp/*.hiv', 'C:/Windows/Temp/*.sam', 'C:/Windows/Temp/*.save',
                 'C:/ProgramData/**/*.hiv', '/tmp/*.hiv', '/tmp/sam*', '/var/tmp/*.save'])

LET conns = SELECT Pid, Name, Status, RaddrIP = Raddr.IP, RaddrPort = Raddr.Port
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RaddrPort in (443, 7844, 2053, 2083, 2087, 2096)
  AND NOT Name =~ '(?i)(w3wp|nginx|apache|httpd|store|edge|chrome)'

SELECT * FROM procs
UNION ALL SELECT NULL AS Pid, 'FILE_ARTIFACT' AS Name, FullPath AS CommandLine,
       str(Size) AS Exe, '' AS Username, Mtime AS CreateTime FROM artifacts

# Jewelbug-Style Intrusion Audit — Exchange/Mail Servers
# Run elevated. Review output before taking action.

$report = @{}

# 1. Audit inbox forwarding rules across all mailboxes (Exchange on-prem/Online)
try {
    $suspiciousRules = Get-Mailbox -ResultSize Unlimited | ForEach-Object {
        Get-InboxRule -Mailbox $_.Alias -ErrorAction SilentlyContinue |
        Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage }
    }
    $report['SuspiciousInboxRules'] = $suspiciousRules | Select-Object MailboxOwnerId, Name, ForwardTo, RedirectTo, DeleteMessage
} catch { Write-Warning "Exchange cmdlets unavailable: $_" }

# 2. Check for tunneling tools running on the host
$report['TunnelingProcesses'] = Get-Process -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'cloudflared|ngrok|chisel|frpc|ligolo' } |
    Select-Object Name, Id, Path, StartTime

# 3. Look for staged credential hive dumps in common staging dirs
$report['PossibleHiveDumps'] = Get-ChildItem -Path "$env:TEMP","C:\Windows\Temp","C:\ProgramData" -Recurse -ErrorAction SilentlyContinue -Depth 2 |
    Where-Object { $_.Extension -in '.hiv','.sam','.save' } |
    Select-Object FullName, Length, LastWriteTime

# 4. Enumerate recently created local admins (persistence check)
$report['LocalAdmins'] = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource

# 5. Recently created scheduled tasks (persistence)
$report['RecentScheduledTasks'] = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-90)
} | Select-Object TaskName, TaskPath, Date

# 6. Unauthorized OpenSSH server installation
$ssh = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' -ErrorAction SilentlyContinue
$report['OpenSSHServerState'] = $ssh.State

# Export findings
$report.GetEnumerator() | ForEach-Object {
    Write-Host "`n=== $($_.Key) ===" -ForegroundColor Cyan
    $_.Value | Format-List
}
$report | ConvertTo-Json -Depth 4 | Out-File "$env:USERPROFILE\Desktop\jewelbug_audit_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Host "`nAudit complete. JSON saved to Desktop." -ForegroundColor Green