SignalHunt
← All rules

ID-9002

critical

Suspicious External Inbox Forwarding Rule Created

Detects a newly created or modified mailbox rule that forwards or redirects mail to an external address. A top post-compromise action after a mailbox takeover - the attacker sets a quiet forwarding rule (often with no visible folder action) so they keep receiving copies of mail, password reset links, and MFA codes even after the victim changes their password.

T1114.003T1098.002
Test this rule in the simulator

Detection logic

Fires as soon as one event matches: `operation` is "New-InboxRule" or "Set-InboxRule" AND `external_forward` is true.

{
  "detection_type": "selection",
  "selection": {
    "operation": [
      "New-InboxRule",
      "Set-InboxRule"
    ],
    "external_forward": true
  }
}

Log source: category=identity · Event ID(s): m365_audit_log

Required log fields

  • mailbox
  • operation
  • forward_to
  • external_forward
  • actor

Enabling this in your environment

Where: Microsoft Purview (compliance center) Unified Audit Log must be enabled, plus the built-in Defender for Office 365 alert policy "Creation of forwarding/redirect rule" (or a custom alert on New-InboxRule/Set-InboxRule with a non-empty ForwardTo/RedirectTo). 

Set-OrganizationConfig -AuditDisabled $false ; Search-UnifiedAuditLog -RecordType ExchangeAdmin -Operations New-InboxRule,Set-InboxRule

Also block external forwarding at the tenant level by default (Exchange Online remote domain auto-forward setting) so this becomes a "should never succeed" event rather than routine self-service - the same posture as WEB rules that treat any hit as the finding itself.

Seen in incidents

False positives

  • A legitimate employee-configured forward to a personal address for convenience, or an approved business process (e.g. shared-mailbox triage) - confirm with the mailbox owner directly rather than assuming compromise, but still treat it as high priority until confirmed

References