Suspicious Mail Forwarding/Redirecting via ExchangePowerShell Cmdlets on Windows

Alerts when PowerShell script blocks reference Exchange inbox/rule cmdlets and forwarding/redirect parameters.

FreeUnreviewedSigmamediumv1

suspicious-mail-forwarding-redirecting-via-exchangepowershell-cmdlets-on-windows-0c7686d5

title: Suspicious Mail Forwarding/Redirecting via ExchangePowerShell Cmdlets on Windows
id: 8a294f52-2847-4075-8159-4da27d630785
related:
  - id: c726e007-2cd0-4a55-abfb-79730fbedee5
    type: similar
  - id: 15b7abbb-8b40-4d01-9ee2-b51994b1d474
    type: obsolete
  - id: 0c7686d5-c74e-4292-b224-2a08e956ebc4
    type: derived
status: experimental
description: This rule flags PowerShell script block content that includes Exchange cmdlets used to create or modify inbox/mail rules associated with email forwarding or redirecting. Attackers may use these capabilities to silently reroute messages to external destinations, enabling interception or data collection while reducing user visibility. It relies on Windows PowerShell script block logging telemetry and matches on specific cmdlet and parameter strings within the recorded script content.
references:
  - https://redcanary.com/blog/email-forwarding-rules/
  - https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_email_forwarding_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-03-01
tags:
  - attack.collection
  - attack.stealth
  - attack.t1114.003
  - attack.t1564.008
  - attack.exfiltration
  - attack.t1020
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - New-InboxRule
      - Set-InboxRule
      - Set-Mailbox
  selection_params:
    ScriptBlockText|contains:
      - ForwardAsAttachmentTo
      - ForwardingAddress
      - ForwardingSmtpAddress
      - ForwardTo
      - RedirectTo
  condition: all of selection_*
falsepositives:
  - Legitimate mail forwarding rules created by users or administrators to forward email to designated internal or external recipients for business or operational purposes.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block content that includes Exchange cmdlets used to create or modify inbox/mail rules associated with email forwarding or redirecting. Attackers may use these capabilities to silently reroute messages to external destinations, enabling interception or data collection while reducing user visibility. It relies on Windows PowerShell script block logging telemetry and matches on specific cmdlet and parameter strings within the recorded script content.

Known false positives

Legitimate mail forwarding rules created by users or administrators to forward email to designated internal or external recipients for business or operational purposes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.