Sunturai
Back to results
MediumSplunk security contentMauricio Velazco +1

O365 New Email Forwarding Rule Created

The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity…

Description

The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters like ForwardTo, ForwardAsAttachmentTo, and RedirectTo. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.

Detection logic

Detection requirements

Platform
LinuxmacOSOffice SuiteWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

  • Users may create email forwarding rules for legitimate purposes. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice