Analytics BIOC Informational
✕

Exchange inbox forwarding rule configured

A user configured an Exchange inbox forwarding rule, which forwards emails that meet specific conditions.

Module:
Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security
Licensed by:
Identity Threat Detection (ITDR)
Licensed by:
Email Security
Data source:
Office 365 Audit
ATT&CK tactics: Collection (TA0009) Exfiltration (TA0010)
ATT&CK techniques: Email Collection: Email Forwarding Rule (T1114.003) Automated Exfiltration (T1020) Email Collection (T1114)
Attacker's goals:

Create an inbox rule using a compromised user account to automatically forward emails containing specific conditions to an external recipient.

Investigative actions:

Check what conditions are met in the inbox rule (e.g. specific keywords in the subject or body). Determine if any of the conditions and keywords look suspicious. Look for signs that the user account and mailbox are compromised (e.g. abnormal logins, unusual activity). Check if the forwarding domain is an unknown external domain and look up its reputation. Investigate the IP address associated with the rule. Follow further actions done by the account. Check for a possible phishing campaign on the organization. Look for emails sent to this recipient by other users.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Exchange inbox forwarding rule configured by a delegate user Informational
  • Suspicious Exchange inbox forwarding rule configured Medium (parent: Informational)
  • External Exchange inbox forwarding rule configured Low (parent: Informational)