Microsoft 365 SMTP forwarding
Mailbox-level SMTP auto-forwarding was configured (Set-Mailbox / Set-RemoteMailbox with ForwardingSmtpAddress or ForwardingAddress).
What it detects
Mailbox-level SMTP auto-forwarding was configured (Set-Mailbox / Set-RemoteMailbox with ForwardingSmtpAddress or ForwardingAddress). Unlike an inbox rule, this forwards a copy of ALL mail out of the tenant at the mailbox level — a stealthy post-BEC exfiltration and persistence path that keeps leaking mail after a password reset and is easy to miss because it lives in mailbox settings, not the rules list.
MITRE ATT&CK mapping
False positives and triage
Admins set forwarding for shared mailboxes and departures legitimately. The signal is forwarding to an EXTERNAL address the user doesn't control, set by an unexpected actor, or right after a suspicious sign-in. DeliverToMailboxAndForward left false (forward-and-delete) is extra suspicious. Review the destination.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/m365_smtp_forwarding.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_smtp_forwarding
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [application]
mitre_techniques: [T1114.003, T1020]
description: |
Mailbox-level SMTP auto-forwarding was configured (Set-Mailbox /
Set-RemoteMailbox with ForwardingSmtpAddress or ForwardingAddress). Unlike an
inbox rule, this forwards a copy of ALL mail out of the tenant at the mailbox
level — a stealthy post-BEC exfiltration and persistence path that keeps leaking
mail after a password reset and is easy to miss because it lives in mailbox
settings, not the rules list.
match:
provider: Office365
event_action_any:
- "Set-Mailbox"
- "Set-RemoteMailbox"
raw_message_contains_any:
- "ForwardingSmtpAddress="
- "ForwardingAddress="
correlation_keys: [user_name]
false_positive_guidance: |
Admins set forwarding for shared mailboxes and departures legitimately. The
signal is forwarding to an EXTERNAL address the user doesn't control, set by an
unexpected actor, or right after a suspicious sign-in. DeliverToMailboxAndForward
left false (forward-and-delete) is extra suspicious. Review the destination.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.