O365 Audit: Detect Mail Forwarding and Redirect Rule Changes

title: "O365 Audit: Detect Mail Forwarding and Redirect Rule Changes"
id: 3be656d1-0ed1-4438-9bda-399d201592f3
status: test
description: This rule flags Microsoft 365 audit log activity related to creating or updating mail forwarding and redirecting configurations. Such changes can enable attackers to silently route copies of email to external recipients, supporting credential theft, persistence, or data exfiltration. It relies on audit log events containing specific operation names (e.g., UpdateInboxRules, Set-Mailbox, New-InboxRule/Set-InboxRule) and parameters that reference forwarding and redirect targets.
references:
  - https://redcanary.com/blog/email-forwarding-rules/
  - https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml
author: RedCanary Team (idea), Harjot Singh @cyb3rjy0t, Huntrule Team
date: 2023-10-11
modified: 2024-11-17
tags:
  - attack.collection
  - attack.stealth
  - attack.t1114.003
  - attack.t1564.008
  - attack.exfiltration
  - attack.t1020
  - detection.threat-hunting
logsource:
  service: audit
  product: m365
  definition: "Requirements: The 'OperationProperties' and 'Parameters' fields are a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search"
detection:
  selection_updateinbox:
    Operation|contains: UpdateInboxRules
    OperationProperties|contains:
      - Forward
      - Recipients
  selection_setmailbox:
    Operation|contains: Set-Mailbox
    Parameters|contains:
      - ForwardingSmtpAddress
      - ForwardingAddress
  selection_setinbox:
    Operation|contains:
      - New-InboxRule
      - Set-InboxRule
    Parameters|contains:
      - ForwardAsAttachmentTo
      - ForwardingAddress
      - ForwardingSmtpAddress
      - ForwardTo
      - RedirectTo
      - RedirectToRecipients
  condition: 1 of selection_*
falsepositives:
  - False positives are expected from legitimate mail forwarding rules. You need organisation specific knowledge. Filter out the domains that are allowed as forwarding targets as well as any additional metadata that you can use for exclusion from trusted sources/targets in order to promote this to a potential detection rule.
level: medium
license: DRL-1.1
related:
  - id: c726e007-2cd0-4a55-abfb-79730fbedee5
    type: derived