Sigma rule: Mail Forwarding/Redirecting Activity In O365

Rule

Title

Mail Forwarding/Redirecting Activity In O365

Status

test

Level

medium

Author

RedCanary Team (idea), Harjot Singh @cyb3rjy0t

Date

2023-10-11

Modified

2024-11-17

File

rules-threat-hunting/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects email forwarding or redirecting activity in O365 Audit logs.

Log source

product

m365

service

audit

definition

Requirements: The 'OperationProperties' and 'Parameters' fields are a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search

Detection

# Note: Might require seperation in the future when enough data is gatherd
selection_updateinbox:
    Operation|contains: 'UpdateInboxRules'
    OperationProperties|contains:
        - 'Forward'
        - 'Recipients'
selection_setmailbox:
    Operation|contains: 'Set-Mailbox'
    Parameters|contains:
        - 'ForwardingSmtpAddress'
        - 'ForwardingAddress'
selection_setinbox:
    Operation|contains:
        - 'New-InboxRule'
        - 'Set-InboxRule'
    Parameters|contains:
        - 'ForwardAsAttachmentTo'
        - 'ForwardingAddress'
        - 'ForwardingSmtpAddress'
        - 'ForwardTo'
        - 'RedirectTo'
        - 'RedirectToRecipients'
condition: 1 of selection_*

False positives (as the rule lists them)

• False positives are expected from legitimate mail forwarding rules. You need organisation specific knowledge. Filter out the domains that are allowed as forwarding targets as well as any additional metadata that you can use for exclusion from trusted sources/targets in order to promote this to a potential detection rule.

Tags

• attack.collection
• attack.stealth
• attack.t1114.003
• attack.t1564.008
• attack.exfiltration
• attack.t1020
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1020
• T1114.003
• T1564.008

References

• https://redcanary.com/blog/email-forwarding-rules/
• https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml