skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-email-forwarding-rules-attack

Detect malicious email forwarding rules used for persistence and BEC attacks.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#siem#email forwarding#Microsoft 365#mitre attack#bec#t1114
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-email-forwarding-rules-attack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-email-forwarding-rules-attack
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-email-forwarding-rules-attack
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-email-forwarding-rules-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Adversaries create hidden email forwarding rules to maintain persistent access to mailboxes for intelligence collection and BEC attacks, and these rules are easy to miss because forwarding can hide in inbox rules, mailbox-level settings, or Exchange transport rules. This Skill guides threat hunters through detecting all three variants using SIEM and EDR telemetry.

Core Features & Use Cases

  • Comprehensive Coverage: Hunts inbox rules (New-InboxRule), mailbox forwarding (Set-Mailbox), and transport rules so no forwarding path is missed.
  • Evasion-Aware Detection: Accounts for unnamed rules, mark-as-read hiding, client-only OWA rules, and OAuth app consent abuse without interactive logons.
  • Validation Workflow: Includes steps to verify audit logging is enabled and to test that benign rules generate expected Unified Audit Log entries.
  • Use Case: During incident response after a suspected account compromise, run the hunt workflow to find rules forwarding executive email to external domains and scope the breach.

Quick Start

Hunt for malicious email forwarding rules in our Microsoft 365 environment by querying the Unified Audit Log for New-InboxRule and Set-Mailbox events with external forwarding addresses.

Frequently Asked Questions about detecting-email-forwarding-rules-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect malicious email forwarding rules in Microsoft 365?▼

Query the Unified Audit Log for New-InboxRule, Set-Mailbox with ForwardingSmtpAddress, and transport rule creation events. Hunt all three operation types since querying only inbox rules covers just a third of the attack surface.

What MITRE ATT&CK technique covers email forwarding rules?▼

Email forwarding rules map to T1114.003 (Email Forwarding Rule), with related techniques T1114.002 (Remote Email Collection) and T1098.002 (Additional Email Delegate Permissions). These are commonly used for persistence and BEC attacks.

Why are my forwarding rule detection queries returning no results?▼

The Unified Audit Log and mailbox auditing may be disabled. Verify with Get-AdminAuditLogConfig and Get-Mailbox | fl AuditEnabled; without UAL, New-InboxRule and Set-Mailbox events are never recorded.

Can attackers create forwarding rules without logging in?▼

Yes. Graph API and malicious OAuth app consent can create rules without an interactive sign-in event. Correlate rule creation with AzureAD audit logs and review risky or newly consented applications.

How do I reduce false positives when hunting forwarding rules?▼

Allowlist legitimate cases like delegates, helpdesk and shared mailboxes, and vacation auto-forwards. Alert specifically on forwarding to external or newly-seen recipient domains to focus on high-risk activity.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced
UnitOneAIUnitOneAI
44

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

Official
Intermediate
YukiIto1999YukiIto1999

detecting-oauth-token-theft

Detect OAuth token theft and replay attacks in Entra ID sign-in logs.

Community
Intermediate
NCLGISANCLGISA

microsoft-defender

Manage Microsoft Defender XDR, Endpoint, and Sentinel security operations.

Official
Advanced