How Attackers Use Email Forwarding Rules After a Break-In

Attackers configure email forwarding rules to silently copy mail to external addresses they control, often hiding the rules from standard interfaces and burying security alerts in rarely-checked folders. These rules survive password resets because they belong to the mailbox configuration rather than the session, letting data exfiltration continue for weeks or months undetected.

What attackers achieve with mailbox rules

Forwarding rules automatically send copies of all incoming messages to attacker-controlled accounts and keep exfiltrating mail after the account owner changes their password (getmailbird.com). Email forwarding rules, once configured, can exfiltrate sensitive communications for extended periods without generating login events, session anomalies, or geographic alerts (adaptivesecurity.com).

The Red Canary team found that attackers create email forwarding rules to establish persistence or collect targeted information, with forwarding to an external domain being the most common method. Another tactic is to delete or move emails to a specific location so they never reach the user, for example creating a rule deleting emails containing financial information and replacing them with phishing emails that contain the attacker's own account details.

Persistence survives password resets because forwarding and suppression rules remain active after credential changes, allowing continued data leakage as long as the rule exists (scworld.com). The forwarding rule continues to operate even after the victim resets their password, since the rule is bound to the mailbox rather than the authentication session (startupdefense.io).

How to find hidden rules in Microsoft 365

The Get-InboxRule -IncludeHidden command is the industry standard for finding rules that are invisible to normal admin tools and shows all the rules in a mailbox, including those made through MAPI manipulation (huntress.com). The PowerShell command Get-InboxRule -Mailbox <Identity> -IncludeHidden | Format-List Name,Enabled,RedirectTo,Forward,Identity reviews all Inbox rules including hidden ones for rules that redirect or forward messages without the user's knowledge.

Three patterns deserve close attention: rules where RedirectTo or ForwardTo points to an external domain, rules with Enabled: True that the account owner never created, and rules whose Description references moving messages into rarely-checked folders such as RSS Subscriptions, Notes, or Junk Email.

Mailbox-level forwarding sits separately from inbox rules. To check whether the mailbox has forwarding settings that redirect messages to another recipient, run Get-Mailbox -Identity <Identity> | Format-List ForwardingAddress,DeliverTo. In Exchange Online PowerShell, enumerate all mailboxes and record ForwardingAddress, ForwardingSmtpAddress and DeliverToMailboxAndForward.

Microsoft's documentation confirms that common symptoms of a compromised account include suspicious Inbox rules, rules that automatically forward email to unknown addresses, and rules that move messages to the Notes, Junk Email, or RSS Subscriptions folders.

How to find forwarding rules in Google Workspace

In Google Workspace, forwarding is set at the user automatic forwarding setting, Gmail filters with a forward action, and admin routing settings, while user accounts log email_forwarding_out_of_domain events. Google Workspace accounts have an additional audit layer where Workspace admins can audit and restrict forwarding for users in the domain from the Admin console.

Review Gmail log events in the audit and investigation tool (Reporting > Audit and investigation), and set alert rules in Security > Alert center so you're notified when users change forwarding settings. Navigate to Reporting → Audit and Investigation → Gmail log events to return results showing both Receive and Autoforward email activity, with the Gmail log events tool capturing message activity including forwarding events.

To block forwarding, clear "Allow users to automatically forward incoming email" or keep it ticked and choose "internal email addresses only" instead of any email address, with the Forwarding option then disappearing from users' Gmail settings.

What alerts catch new forwarding rules?

In enterprise tenants, administrators learn when users create a forwarding rule through the default "Creation of forwarding/redirect rule" alert policy, which relies on simple detection of an audit record noting the creation of a forwarding rule and generates an email to alert tenant administrators. Inbox rules which forward emails to external addresses that are created after the Office 365 audit log has finished preparing are successfully flagged by the pre-configured alert.

For most organizations, Application Log Content will provide the visibility necessary to detect suspicious email forwarding rules, which for Office 365 includes the Unified Audit Log. For Microsoft 365 organizations, this involves enabling mailbox audit logging for all users and monitoring specifically for operations including "New-InboxRule," "Set-InboxRule," "Set-Mailbox" with ForwardingSmtpAddress parameters, and "UpdateInboxRules" that indicate forwarding rule creation or modification.

You should look for operations labeled "UpdateInboxRules" combined with properties including "Forward" and "Recipients" to identify suspicious inbox rules, while "Set-Mailbox" operations with "ForwardingSmtpAddress" or "ForwardingAddress" parameters indicate auto-forwarding configurations.

The free AI-visibility check (/check) surfaces whether your clients appear when potential customers ask Claude, ChatGPT, Gemini or Perplexity who to hire, which matters because the same gaps that let attackers in often correlate with weak AI visibility.

How can you prevent external forwarding before a breach?

Disabling automatic forwarding disables any Inbox rules (users) or mailbox forwarding (admins) that redirect messages to external addresses. Prevention of external email forwarding represents a stronger security approach than detection alone, with Microsoft 365 administrators able to configure outbound spam filter policies to restrict automatic forwarding to external recipients.

Conditions and actions in Exchange mail flow rules detect and block automatically forwarded messages to external recipients by Inbox rules, by entering the header X-MS-Exchange-Inbox-Rules-Loop and matching it to the pattern "."

For MSPs managing multiple tenants, the guide (/guide) walks through what else to check during incident response beyond just forwarding rules. Many clients ask about ActiScore's pricing (/pricing) after discovering how many gaps exist across their client base, since the Starter plan at $79/month covers 250 scans and includes white-labelling from day one.

Multi-tenant detection requires consistent investigation, with MSPs needing to combine hidden-rule inspection, Microsoft Purview audit logs, and identity activity to identify suspicious changes across client tenants with different licensing, retention periods, and audit configurations. For continuous monitoring, configure a Microsoft Sentinel analytics rule or a Defender for Office 365 custom detection that alerts any time a forwarding action is set on a mailbox, with the initiating user and IP address included in the alert.