Mail Rules
Overview
Evidence: Mail Rules
Description: Collect Mail Rules that contain AppleScript
Category: System
Platform: macos
Short Name: mrls
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Apple Mail rules can trigger AppleScripts on incoming mail. This data is essential for detecting malicious scripts used for persistence, exfiltration, or auto‑actions.
Data Collected
This collector gathers structured data about mail rules.
Mail Rules Data
| Field | Description | Example |
|---|---|---|
User | User | Example value |
RulePath | Rule Path | Example value |
Key | Key | Example value |
Script | Script | Example value |
ScriptPath | Script Path | Example value |
Collection Method
This collector searches for SyncedRules.plist files, extracts AppleScript rule entries, and records them into mail_rules.
Forensic Value
This evidence is crucial for forensic investigations as it reveals script execution hooks configured in Mail, a known persistence vector.