Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0576 — Email Forwarding Rule Abuse Detection Across Platforms
DET0576

Email Forwarding Rule Abuse Detection Across Platforms

4 analytic(s) · 1 technique(s) detected

Analytics

4
AN1589 Analytic 1589
Windows

Creation of inbox rules via PowerShell (New-InboxRule) or transport rules using Exchange cmdlets. Correlates user behavior, cmdlet usage, and rule properties.

WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 WinEventLog:Security EventCode=4688 m365:exchange Cmdlet - New-InboxRule
[UserContext] Certain service accounts or admin contexts may be expected to run these rules.
[TimeWindow] Correlate between rule creation and follow-on message forwarding within this timeframe.
[TargetMailbox] Whitelisted or trusted destination addresses may be tuned per org policy.
AN1590 Analytic 1590
macOS

Creation or modification of Apple Mail rules by accessing plist files or GUI automation (AppleScript).

macos:unifiedlog log stream --predicate fs:plist_monitoring /Users/*/Library/Mail/V*/MailData/RulesActiveState.plist
[RuleFilePath] Different Mail versions store rules in slightly different locations.
[ScriptTrigger] AppleScript usage for GUI automation may be common in automation workflows.
AN1591 Analytic 1591
Office Suite

Creation of email forwarding/redirect rules in Exchange Online via New-InboxRule or transport rule cmdlets, including auto-forwarding address field usage.

m365:unified New-InboxRule, Set-InboxRule m365:messagetrace X-MS-Exchange-Organization-AutoForwarded
[ForwardingSMTPAddress] Destination domain may vary; commonly tuned per org policies.
[ActorId] Differentiate service/admin users vs standard user population.
AN1592 Analytic 1592
Linux

Modification of Thunderbird message filters file or execution of CLI tools (e.g., formail/procmail) that alter .forward behavior.

auditd:SYSCALL write linux:cli /home/*/.bash_history
[.forwardPath] User-based home directories; tune for specific user patterns.
[ExecContext] Expected email client behavior may trigger similar file edits.

Detected Techniques

1

Details

MITRE ID
DET0576
STIX ID
x-mitre-detection-strategy--f66a9e86-49fb-4de6-963d-0e357a77f679
Analytics
4
Techniques Detected
1
By Tactic
Collection
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.