Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules
Flags successful Microsoft Cloud App Security alerts for suspicious inbox forwarding behavior.
- Product
- m365
- Service
- threat_management
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-22
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful “Suspicious inbox forwarding” events reported by Microsoft Cloud App Security (Microsoft 365). Attackers commonly abuse inbox forwarding to exfiltrate email content by silently copying or forwarding messages to an external destination. Detection relies on threat management telemetry from the SecurityComplianceCenter service, including the event source, event name, and success status.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules
id: 71fbc42d-8626-4447-9ab9-ae4e8321d2c1
status: test
description: This rule identifies successful “Suspicious inbox forwarding” events reported by Microsoft Cloud App Security (Microsoft 365). Attackers commonly abuse inbox forwarding to exfiltrate email content by silently copying or forwarding messages to an external destination. Detection relies on threat management telemetry from the SecurityComplianceCenter service, including the event source, event name, and success status.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-22
modified: 2022-10-09
tags:
- attack.exfiltration
- attack.t1020
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Suspicious inbox forwarding
status: success
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 6c220477-0b5b-4b25-bb90-66183b4089e8
type: derived