Microsoft 365 Threat Management: Alert on Suspicious Inbox Forwarding

title: "Microsoft 365 Threat Management: Alert on Suspicious Inbox Forwarding"
id: 71fbc42d-8626-4447-9ab9-ae4e8321d2c1
status: test
description: This rule flags successful “Suspicious inbox forwarding” events reported by Microsoft Cloud App Security through the SecurityComplianceCenter. It is meant to catch inbox rule activity consistent with attackers attempting to forward copies of incoming emails to external recipients, which can enable data exfiltration or persistence. The detection relies on threat management telemetry including eventSource, eventName, and a success status.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-22
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Suspicious inbox forwarding
    status: success
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 6c220477-0b5b-4b25-bb90-66183b4089e8
    type: derived