T1114.003sub-technique of T1114 Email Collection
Email Forwarding Rule
Linux · macOS · Office Suite · Windows6 pieces on this siteT1114.003 on attack.mitre.org
Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Cloud account takeover response plan: sessions, methods, devices and grants, then what they read
A successful sign-in the user did not make, in Microsoft Entra ID and Microsoft 365. A password reset alone evicts almost nobody. The plan works through the order that does, how to tell a guessed password from a stolen session, and how to answer what they read.
Business email compromise response plan: the money first, then the mailbox
Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
The payment has already gone
A supplier says they never received it, or a bank detail change turns out to be fraudulent.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
Impossible travel, and then a mailbox rule
You have fifteen minutes. What are your first three queries, in order, and what single action do you take before any of them? Write down what you expect each query to return before you run it.
how MITRE says to see it
Email Forwarding Rule Abuse Detection Across Platforms
- Creation of inbox rules via PowerShell (New-InboxRule) or transport rules using Exchange cmdlets. Correlates user behavior, cmdlet usage, and rule properties.
- Creation or modification of Apple Mail rules by accessing plist files or GUI automation (AppleScript).
- Creation of email forwarding/redirect rules in Exchange Online via New-InboxRule or transport rule cmdlets, including auto-forwarding address field usage.
- Modification of Thunderbird message filters file or execution of CLI tools (e.g., formail/procmail) that alter.forward behavior.
what reduces it
- M1060 Out-of-Band Communications Channel. Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests. For highly sensitive information, utilize out-of-band communication channels instead of relying solely on email. This reduces the risk of sensitive data being collected through compromised email accounts.
- M1047 Audit. Enterprise email solutions have monitoring mechanisms that may include the ability to audit auto-forwarding rules on a regular basis. In an Exchange environment, Administrators can use `Get-InboxRule` / `Remove-InboxRule` and `Get-TransportRule` / `Remove-TransportRule` to discover and remove potentially malicious auto-fowarding and transport rules.
- M1042 Disable or Remove Feature or Program. Consider disabling external email forwarding.
- M1041 Encrypt Sensitive Information. Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.