Star BlizzardG1033 ↗
Has abused email forwarding rules to monitor the activities of a victim, steal information, and maintain persistent access after compromised credentials are reset.12
- Tactic
- Collection
- Platforms
- Linux, macOS, Office Suite, Windows
- Version
- 1.4
- Created
- 19 February 2020
- Last modified
- 24 October 2025
- Contributors
- Microsoft Security; Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC); Liran Ravich, CardinalOps; Arun Seelagan, CISA
Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.[1] Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.[2] Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.[3][4]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Email Forwarding Rule MITRE reference T1114.003
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Scattered SpiderG1015 ↗
Has redirected emails notifying users of suspicious account activity.1
LAPSUS$G1004 ↗
Has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.1
Silent LibrarianG0122 ↗
Has set up auto forwarding rules on compromised e-mail accounts.1
KimsukyG0094 ↗
Has set auto-forward rules on victim's e-mail accounts.1
All 5 groups for this technique
Offense vs defense T1114.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 6
first rule: 2023 Q3Email Forwarding Rule detection strategy DET0576
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Email Forwarding Rule Abuse Detection Across Platforms
4 platforms
AN1589 · Windows
Creation of inbox rules via PowerShell (New-InboxRule) or transport rules using Exchange cmdlets. Correlates user behavior, cmdlet usage, and rule properties.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Cloud Service MetadataDC0070 | m365:exchange | Cmdlet - New-InboxRule |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Certain service accounts or admin contexts may be expected to run these rules. |
| TimeWindow | Correlate between rule creation and follow-on message forwarding within this timeframe. |
| TargetMailbox | Whitelisted or trusted destination addresses may be tuned per org policy. |
AN1590 · macOS
Creation or modification of Apple Mail rules by accessing plist files or GUI automation (AppleScript).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | fs:plist_monitoring | /Users/*/Library/Mail/V*/MailData/RulesActiveState.plist |
| Command ExecutionDC0064 | macos:unifiedlog | log stream --predicate |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RuleFilePath | Different Mail versions store rules in slightly different locations. |
| ScriptTrigger | AppleScript usage for GUI automation may be common in automation workflows. |
AN1591 · Office Suite
Creation of email forwarding/redirect rules in Exchange Online via New-InboxRule or transport rule cmdlets, including auto-forwarding address field usage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:messagetrace | X-MS-Exchange-Organization-AutoForwarded |
| Cloud Service MetadataDC0070 | m365:unified | New-InboxRule, Set-InboxRule |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ForwardingSMTPAddress | Destination domain may vary; commonly tuned per org policies. |
| ActorId | Differentiate service/admin users vs standard user population. |
AN1592 · Linux
Modification of Thunderbird message filters file or execution of CLI tools (e.g., formail/procmail) that alter .forward behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | auditd:SYSCALL | write |
| Command ExecutionDC0064 | linux:cli | /home/*/.bash_history |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| .forwardPath | User-based home directories; tune for specific user patterns. |
| ExecContext | Expected email client behavior may trigger similar file edits. |
AuditM1047
Enterprise email solutions have monitoring mechanisms that may include the ability to audit auto-forwarding rules on a regular basis.
In an Exchange environment, Administrators can use Get-InboxRule / Remove-InboxRule and Get-TransportRule / Remove-TransportRule to discover and remove potentially malicious auto-fowarding and transport rules. In addition to this, a MAPI Editor can be utilized to examine the underlying database structure and discover any modifications/tampering of the properties of auto-forwarding rules.
Consider disabling external email forwarding.
Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.
Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests. For highly sensitive information, utilize out-of-band communication channels instead of relying solely on email. This reduces the risk of sensitive data being collected through compromised email accounts. Set up out-of-band alerts to notify security teams of unusual email activities, such as mass forwarding or large attachments being sent, which could indicate email collection attempts. Create plans for leveraging a secure out-of-band communications channel, rather than an existing in-network email server, in case of a security incident.
Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformsoffice-365
Tests from Atomic Red Team (MIT licence) · technique definition