{"id":"T1114.003","name":"Email Forwarding Rule","url":"https://attack.mitre.org/techniques/T1114/003","tactics":["collection"],"platforms":["Linux","macOS","Office Suite","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0576","stix_id":"x-mitre-detection-strategy--f66a9e86-49fb-4de6-963d-0e357a77f679","name":"Email Forwarding Rule Abuse Detection Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0576","analytics":[{"id":"AN1589","stix_id":"x-mitre-analytic--fe489775-b01e-4da2-a0e2-962d1572ba09","name":"Analytic 1589","description":"Creation of inbox rules via PowerShell (New-InboxRule) or transport rules using Exchange cmdlets. Correlates user behavior, cmdlet usage, and rule properties.","url":"https://attack.mitre.org/detectionstrategies/DET0576#AN1589","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"m365:exchange","channel":"Cmdlet - New-InboxRule","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"m365-exchange"}],"mutable_elements":[{"field":"UserContext","description":"Certain service accounts or admin contexts may be expected to run these rules."},{"field":"TimeWindow","description":"Correlate between rule creation and follow-on message forwarding within this timeframe."},{"field":"TargetMailbox","description":"Whitelisted or trusted destination addresses may be tuned per org policy."}],"live":true,"detection_strategies":["DET0576"],"techniques":["T1114.003"]},{"id":"AN1590","stix_id":"x-mitre-analytic--c93edcb2-385a-4472-a9db-ace5371250eb","name":"Analytic 1590","description":"Creation or modification of Apple Mail rules by accessing plist files or GUI automation (AppleScript).","url":"https://attack.mitre.org/detectionstrategies/DET0576#AN1590","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream --predicate","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"fs:plist_monitoring","channel":"/Users/*/Library/Mail/V*/MailData/RulesActiveState.plist","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-plist-monitoring"}],"mutable_elements":[{"field":"RuleFilePath","description":"Different Mail versions store rules in slightly different locations."},{"field":"ScriptTrigger","description":"AppleScript usage for GUI automation may be common in automation workflows."}],"live":true,"detection_strategies":["DET0576"],"techniques":["T1114.003"]},{"id":"AN1591","stix_id":"x-mitre-analytic--710aa303-3e9f-4170-95a4-b2caf5f827fd","name":"Analytic 1591","description":"Creation of email forwarding/redirect rules in Exchange Online via New-InboxRule or transport rule cmdlets, including auto-forwarding address field usage.","url":"https://attack.mitre.org/detectionstrategies/DET0576#AN1591","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"New-InboxRule, Set-InboxRule","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"m365-unified"},{"name":"m365:messagetrace","channel":"X-MS-Exchange-Organization-AutoForwarded","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-messagetrace"}],"mutable_elements":[{"field":"ForwardingSMTPAddress","description":"Destination domain may vary; commonly tuned per org policies."},{"field":"ActorId","description":"Differentiate service/admin users vs standard user population."}],"live":true,"detection_strategies":["DET0576"],"techniques":["T1114.003"]},{"id":"AN1592","stix_id":"x-mitre-analytic--22e6f5f4-e4cc-449c-9dba-280788935ce5","name":"Analytic 1592","description":"Modification of Thunderbird message filters file or execution of CLI tools (e.g., formail/procmail) that alter .forward behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0576#AN1592","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"linux:cli","channel":"/home/*/.bash_history","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-cli"}],"mutable_elements":[{"field":".forwardPath","description":"User-based home directories; tune for specific user patterns."},{"field":"ExecContext","description":"Expected email client behavior may trigger similar file edits."}],"live":true,"detection_strategies":["DET0576"],"techniques":["T1114.003"]}],"live":true,"version":"1.0","techniques":["T1114.003"]}],"sigma_rules":[{"id":"04580eed-e1d6-426b-a570-f6e64a4577f7","title":"Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-02-10","modified":null,"description":"Detects inbox rule creation or update via ExchangePowerShell cmdlet, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.\nThe usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.\nAnalysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.\n","references":["https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1564.008","attack.exfiltration","attack.collection","attack.t1114.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml","techniques":["T1564.008","T1114.003"],"cves":[]},{"id":"0c7686d5-c74e-4292-b224-2a08e956ebc4","title":"Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet","author":"Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-03-01","modified":null,"description":"Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet","references":["https://redcanary.com/blog/email-forwarding-rules/","https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.collection","attack.stealth","attack.t1114.003","attack.t1564.008","attack.exfiltration","attack.t1020","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_email_forwarding_activity.yml","techniques":["T1114.003","T1564.008","T1020"],"cves":[]},{"id":"27e4f1d6-ae72-4ea0-8a67-77a73a289c3d","title":"Suspicious Inbox Forwarding Identity Protection","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","status":"test","level":"high","date":"2023-09-03","modified":null,"description":"Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address","references":["https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding","https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins"],"logsource":{"product":"azure","service":"riskdetection"},"tags":["attack.t1114.003","attack.collection"],"path":"rules/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml","techniques":["T1114.003"],"cves":[]},{"id":"2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5","title":"Google Workspace Out Of Domain Email Forwarding","author":"Tom kluter","status":"experimental","level":"medium","date":"2026-04-28","modified":null,"description":"Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.","references":["https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain"],"logsource":{"product":"gcp","service":"google_workspace.login"},"tags":["attack.t1114.003","attack.collection"],"path":"rules/cloud/gcp/gworkspace/login/gcp_gworkspace_out_of_domain_email_forwarding.yml","techniques":["T1114.003"],"cves":[]},{"id":"c726e007-2cd0-4a55-abfb-79730fbedee5","title":"Mail Forwarding/Redirecting Activity In O365","author":"RedCanary Team (idea), Harjot Singh @cyb3rjy0t","status":"test","level":"medium","date":"2023-10-11","modified":"2024-11-17","description":"Detects email forwarding or redirecting activity in O365 Audit logs.","references":["https://redcanary.com/blog/email-forwarding-rules/","https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf"],"logsource":{"product":"m365","service":"audit"},"tags":["attack.collection","attack.stealth","attack.t1114.003","attack.t1564.008","attack.exfiltration","attack.t1020","detection.threat-hunting"],"path":"rules-threat-hunting/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml","techniques":["T1114.003","T1564.008","T1020"],"cves":[]},{"id":"d3577be1-42c9-44a7-b56e-2e8de97349d3","title":"Inbox Rules Creation Or Update Activity in O365","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-01-09","modified":null,"description":"Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.\nThe usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.\nAnalysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.\n","references":["https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps","https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps"],"logsource":{"product":"m365","service":"audit"},"tags":["attack.stealth","attack.t1564.008","attack.exfiltration","attack.collection","attack.t1114.003","detection.threat-hunting"],"path":"rules-threat-hunting/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml","techniques":["T1564.008","T1114.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}