Microsoft 365 mail exfil to consumer account
A tenant mailbox sent mail carrying a document- or credential-shaped subject to a CONSUMER mail provider, and it was delivered.
What it detects
A tenant mailbox sent mail carrying a document- or credential-shaped subject to a CONSUMER mail provider, and it was delivered.
This is exfiltration through the one outbound channel every business permits. After taking a mailbox, an attacker rarely needs malware to get data out — they forward it to an address they control, and a free-mail account is the obvious choice because it costs nothing and needs no infrastructure.
Message trace is the only source that shows this. The audit log records that a forwarding RULE was created; it does not record that a specific message with "Sensitive documents for review" in the subject reached attacker@gmail.com — and in a live case that is the question that decides whether a breach is notifiable.
MITRE ATT&CK mapping
False positives and triage
Employees mail themselves things. Forwarding a document to a personal address before a flight is a policy problem, not an incident, and it will match this rule — the subject list is chosen to sit above pure noise, not to eliminate it.
Three discriminators separate the two:
* **Is the recipient the sender's own personal address?** A one-off to a plausibly-personal account is different from mail to an address nobody in the organisation recognises. * **What else did the account do?** An exfil send after a risky sign-in, a new inbox rule, or a registered MFA method is an incident. On its own, on a Tuesday afternoon, it is usually a conversation with HR. * **Volume and timing.** One message is a habit; a burst outside working hours is a collection.
FW:/Fwd: is included deliberately and is the noisiest term here. It earns its place because a forward is how a mailbox's existing contents leave, and the alternative — waiting for a subject that admits what it contains — misses the ordinary case.
Note the rule requires DELIVERED. Mail the tenant's own policy blocked is a different and much better outcome, and is not reported here.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/m365_mail_exfil_to_consumer_account.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mail_exfil_to_consumer_account
version: 1.0.0
status: stable
severity: high
confidence: 0.65
platforms: [application]
mitre_techniques: [T1567, T1114, T1020]
description: |
A tenant mailbox sent mail carrying a document- or credential-shaped subject to
a CONSUMER mail provider, and it was delivered.
This is exfiltration through the one outbound channel every business permits.
After taking a mailbox, an attacker rarely needs malware to get data out — they
forward it to an address they control, and a free-mail account is the obvious
choice because it costs nothing and needs no infrastructure.
Message trace is the only source that shows this. The audit log records that a
forwarding RULE was created; it does not record that a specific message with
"Sensitive documents for review" in the subject reached
`attacker@gmail.com` — and in a live case that is the question that decides
whether a breach is notifiable.
match:
provider: Office365
event_action: message_delivered
# knowledge/business-context.yaml -> consumer_mail_domains
ext:m365.recipient_domain_contains_any:
- gmail.com
- googlemail.com
- outlook.com
- hotmail.com
- live.com
- msn.com
- yahoo.com
- yahoo.co.uk
- ymail.com
- rocketmail.com
- icloud.com
- me.com
- mac.com
- proton.me
- protonmail.com
- tutanota.com
- tuta.io
- aol.com
- gmx.com
- gmx.net
- mail.com
- zoho.com
- yandex.com
# A consumer recipient ALONE is ordinary — most businesses correspond with
# some. The subject is what makes it a finding.
# knowledge/business-context.yaml -> mail_lure_subjects.document_lure + forwards
ext:m365.subject_contains_any:
- "sensitive document"
- "documents for review"
- "accounts and password"
- "passwords"
- "credentials"
- "fw:"
- "fwd:"
- "confidential"
- "payroll"
- "bank details"
- "customer list"
- "client list"
correlation_keys: [user_name]
false_positive_guidance: |
Employees mail themselves things. Forwarding a document to a personal address
before a flight is a policy problem, not an incident, and it will match this
rule — the subject list is chosen to sit above pure noise, not to eliminate it.
Three discriminators separate the two:
* **Is the recipient the sender's own personal address?** A one-off to a
plausibly-personal account is different from mail to an address nobody in
the organisation recognises.
* **What else did the account do?** An exfil send after a risky sign-in, a new
inbox rule, or a registered MFA method is an incident. On its own, on a
Tuesday afternoon, it is usually a conversation with HR.
* **Volume and timing.** One message is a habit; a burst outside working
hours is a collection.
`FW:`/`Fwd:` is included deliberately and is the noisiest term here. It earns
its place because a forward is how a mailbox's existing contents leave, and the
alternative — waiting for a subject that admits what it contains — misses the
ordinary case.
Note the rule requires DELIVERED. Mail the tenant's own policy blocked is a
different and much better outcome, and is not reported here.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.