<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: detecting-email-forwarding-abuse
description: >-
  Detect and prevent abuse of email forwarding rules including inbox rules
  that auto-forward to external addresses, transport rule manipulation,
  and mailbox delegation abuse used in BEC and data exfiltration.
domain: cybersecurity
subdomain: email-security
tags:
  - forwarding
  - inbox-rules
  - bec
  - data-exfiltration
  - transport-rules
  - delegation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1114.003", "T1564.008"]
  tools: [python3, powershell, jq, grep]
---

# Detecting Email Forwarding Abuse

## Overview

Attackers frequently establish email forwarding rules after compromising
mailboxes to maintain persistent access to communications. This includes
inbox rules forwarding to external addresses, transport rule manipulation,
and abuse of mailbox delegation. Detection requires auditing rule creation
events, scanning for external forwarding targets, and monitoring delegation changes.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Exchange admin access | Audit inbox rules and transport rules |
| Unified Audit Log | Track rule creation and modification events |
| PowerShell (ExchangeOnline) | Query mailbox rules programmatically |
| SIEM | Correlate forwarding with suspicious sign-in activity |

## Workflow

### Step 1: Audit Inbox Rules for External Forwarding

```powershell
# List all inbox rules with forwarding for a specific mailbox
Get-InboxRule -Mailbox user@example.com | Where-Object {
  $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo
} | Select-Object Name, ForwardTo, ForwardAsAttachmentTo, RedirectTo, Enabled

# Scan ALL mailboxes for external forwarding rules
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  $mbx = $_.UserPrincipalName
  Get-InboxRule -Mailbox $mbx -ErrorAction SilentlyContinue |
    Where-Object { $_.ForwardTo -match "SMTP:" -or $_.RedirectTo -match "SMTP:" } |
    Select-Object @{N='Mailbox';E={$mbx}}, Name, ForwardTo, RedirectTo
}
```

### Step 2: Check Transport Rules

```powershell
# List transport rules that redirect or BCC externally
Get-TransportRule | Where-Object {
  $_.BlindCopyTo -or $_.RedirectMessageTo -or $_.CopyTo
} | Select-Object Name, State, BlindCopyTo, RedirectMessageTo, Priority

# Check for recently modified transport rules
Get-TransportRule | Where-Object {
  $_.WhenChanged -gt (Get-Date).AddDays(-30)
} | Select-Object Name, WhenChanged, State
```

### Step 3: Monitor Unified Audit Log

```powershell
# Search for inbox rule creation events
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
  -Operations "New-InboxRule","Set-InboxRule","Enable-InboxRule" `
  -ResultSize 1000 | Select-Object CreationDate, UserIds, Operations, AuditData

# Search for mailbox forwarding configuration changes
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
  -Operations "Set-Mailbox" -ResultSize 1000 |
  Where-Object { $_.AuditData -match "ForwardingSmtpAddress|ForwardingAddress" }
```

### Step 4: Check Mailbox-Level Forwarding

```powershell
# Find mailboxes with SMTP forwarding configured
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select-Object UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| New inbox rule with external forward | Unified Audit Log | Rule created forwarding to non-org domain |
| Mailbox forwarding enabled | Exchange admin audit | ForwardingSmtpAddress set to external |
| Transport rule BCC | Transport rule audit | BCC to external address added |

```yaml
title: Inbox Rule Created with External Forwarding
id: b2c3d4e5-f678-9012-abcd-ef1234567890
status: experimental
description: Detects creation of inbox rules that forward email to external addresses
logsource:
  category: application
  product: o365
detection:
  selection:
    Operation:
      - "New-InboxRule"
      - "Set-InboxRule"
    AuditData|contains:
      - "ForwardTo"
      - "RedirectTo"
      - "ForwardAsAttachmentTo"
  filter:
    AuditData|contains: "@example.com"
  condition: selection and not filter
falsepositives:
  - Legitimate forwarding to partner organizations
  - Vacation auto-forwarding to personal email
level: high
tags:
  - attack.t1114.003
  - attack.collection
```

## Verification

- [ ] All mailboxes scanned for external forwarding rules
- [ ] Transport rules audited for unauthorized redirect/BCC
- [ ] Unified Audit Log queries detect rule creation events
- [ ] Mailbox-level forwarding addresses reviewed
- [ ] Alerting configured for new external forwarding rules
- [ ] Forwarding to external domains blocked by default policy

## References

- [MITRE T1114.003 — Email Collection: Email Forwarding Rule](https://attack.mitre.org/techniques/T1114/003/)
- [Microsoft — Manage mail flow rules](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)
- [CISA — BEC Forwarding Rules Advisory](https://www.cisa.gov/news-events/cybersecurity-advisories)

---
v1.0 | Validated: 2026-03-18
