Azure Risk Detection: Suspicious Inbox Forwarding Identity Protection Events

title: "Azure Risk Detection: Suspicious Inbox Forwarding Identity Protection Events"
id: 193f4ee5-f232-4b22-bcd3-02c12b20b8c7
status: test
description: This rule flags Azure Identity Protection risk events of type suspiciousInboxForwarding, indicating an inbox forwarding configuration that may copy incoming emails to an external address. Attackers can use inbox forwarding to exfiltrate sensitive communications while maintaining access to the target account. The detection relies on the risk event telemetry emitted by Azure riskdetection for riskEventType values matching suspiciousInboxForwarding.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.t1114.003
  - attack.collection
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: suspiciousInboxForwarding
  condition: selection
falsepositives:
  - A legitimate forwarding rule.
level: high
license: DRL-1.1
related:
  - id: 27e4f1d6-ae72-4ea0-8a67-77a73a289c3d
    type: derived