Detect Email Forwarding/Redirecting via Exchange PowerShell InboxRule Cmdlets on Windows
Alerts when PowerShell script blocks reference Exchange inbox/rule cmdlets and forwarding/redirect parameters.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2026-03-01
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block activity that includes Exchange mailbox/inbox rule cmdlet usage associated with creating or modifying email forwarding and redirecting behavior. Attackers commonly use mailbox rule changes to reroute messages to attacker-controlled recipients while avoiding direct email tampering, making this a key stealth and persistence signal. It relies on Windows PowerShell Script Block Logging telemetry and matches specific cmdlets and forwarding/redirect parameters within recorded script content.
Reporting behind it
- redcanary.comhttps://redcanary.com/blog/email-forwarding-rules/
- github.comhttps://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_email_forwarding_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Detect Email Forwarding/Redirecting via Exchange PowerShell InboxRule Cmdlets on Windows
id: 8a294f52-2847-4075-8159-4da27d630785
related:
- id: c726e007-2cd0-4a55-abfb-79730fbedee5
type: similar
- id: 15b7abbb-8b40-4d01-9ee2-b51994b1d474
type: obsolete
- id: 0c7686d5-c74e-4292-b224-2a08e956ebc4
type: derived
status: experimental
description: This rule identifies PowerShell script block activity that includes Exchange mailbox/inbox rule cmdlet usage associated with creating or modifying email forwarding and redirecting behavior. Attackers commonly use mailbox rule changes to reroute messages to attacker-controlled recipients while avoiding direct email tampering, making this a key stealth and persistence signal. It relies on Windows PowerShell Script Block Logging telemetry and matches specific cmdlets and forwarding/redirect parameters within recorded script content.
references:
- https://redcanary.com/blog/email-forwarding-rules/
- https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_email_forwarding_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-03-01
tags:
- attack.collection
- attack.stealth
- attack.t1114.003
- attack.t1564.008
- attack.exfiltration
- attack.t1020
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmdlet:
ScriptBlockText|contains:
- New-InboxRule
- Set-InboxRule
- Set-Mailbox
selection_params:
ScriptBlockText|contains:
- ForwardAsAttachmentTo
- ForwardingAddress
- ForwardingSmtpAddress
- ForwardTo
- RedirectTo
condition: all of selection_*
falsepositives:
- Legitimate mail forwarding rules created by users or administrators to forward email to designated internal or external recipients for business or operational purposes.
level: medium
license: DRL-1.1