Mail Rules
Overview
Section titled “Overview”Evidence: Mail Rules
Description: Collect Mail Rules that contain AppleScript
Category: System
Platform: macos
Short Name: mrls
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Apple Mail rules can trigger AppleScripts on incoming mail. This data is essential for detecting malicious scripts used for persistence, exfiltration, or auto‑actions.
Data Collected
Section titled “Data Collected”This collector gathers structured data about mail rules.
Mail Rules Data
Section titled “Mail Rules Data”| Field | Description | Example |
|---|---|---|
User | User | Example value |
RulePath | Rule Path | Example value |
Key | Key | Example value |
Script | Script | Example value |
ScriptPath | Script Path | Example value |
Collection Method
Section titled “Collection Method”This collector searches for SyncedRules.plist files, extracts AppleScript rule entries, and records them into mail_rules.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it reveals script execution hooks configured in Mail, a known persistence vector.