Detect Business Email Compromise via Forwarding and Deleting Inbox Rules (Microsoft 365)

title: M365 Inbox Rule or Mailbox Forwarding That Hides or Exfiltrates Mail
id: 4c9d2e83-5b71-4a26-9f18-3e7a1c6b9d06
status: experimental
description: >
  Detects the two Exchange Online changes behind most business email
  compromise: an inbox rule created or changed (New-InboxRule, Set-InboxRule)
  with an action that forwards, redirects or deletes messages, and mailbox
  forwarding set with Set-Mailbox (ForwardingSmtpAddress, ForwardingAddress).
references:
  - https://attack.mitre.org/techniques/T1114/003/
  - https://attack.mitre.org/techniques/T1564/008/
author: LogTriage
date: 2026/06/23
modified: 2026/10/20
logsource:
  product: m365
  service: exchange
detection:
  inbox_rule_hides_or_forwards:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
    Parameters|contains:
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
      - 'DeleteMessage'
  mailbox_forwarding:
    Operation: 'Set-Mailbox'
    Parameters|contains:
      - 'ForwardingSmtpAddress'
      - 'ForwardingAddress'
  condition: inbox_rule_hides_or_forwards or mailbox_forwarding
falsepositives:
  - Users forwarding mail to a personal or delegate address
  - Admin mailbox forwarding during onboarding, offboarding or migration
level: high
tags:
  - attack.collection
  - attack.t1114.003
  - attack.defense_evasion
  - attack.t1564.008

What this rule detects

Business email compromise almost always leaves the same fingerprint in the Microsoft 365 Unified Audit Log: shortly after a mailbox takeover, the attacker makes sure a copy of incoming mail goes somewhere they control, and that replies and alerts disappear before the owner sees them.

This rule fires on the two changes that do that:

1. An inbox rule that forwards, redirects or deletes: New-InboxRule or Set-InboxRule with a ForwardTo, ForwardAsAttachmentTo, RedirectTo or DeleteMessage parameter.
2. Mailbox forwarding: Set-Mailbox with ForwardingSmtpAddress or ForwardingAddress.

Detection logic

Two selections, either of which fires the rule. Each pairs the operation with the parameter that makes it dangerous, so ordinary sorting rules (move newsletters to a folder, flag mail from the boss) never match. In the Unified Audit Log, the rule’s settings are recorded as a list of name/value pairs in Parameters, and the rule matches on the parameter names.

Validated against a real sample

Validated against m365_bec_data_exfil.json (shipped with LogTriage). The rule fires on two of its eight events:

• New-InboxRule named “Forward to external”, with ForwardTo: [email protected], SubjectContainsWords: invoice,payment,wire and DeleteMessage: True: payment-related mail is forwarded out and then deleted
• Set-Mailbox with ForwardingSmtpAddress: [email protected] and DeliverToMailboxAndForward: False: every message is forwarded, and the owner’s copy is not kept

The rest of the file is the follow-through (SharePoint downloads, a sharing invitation, a role change and MailItemsAccessed), which other rules cover. The rule stays silent on the matching benign log of file access, a send-as, a sign-in and a Teams session, which contains no inbox rules or mailbox changes at all.

False positives

Users do legitimately forward mail, to a personal address or a delegate, and administrators set mailbox forwarding during onboarding, offboarding and migrations. Triage by the destination (external free-mail is the strongest signal) and by the actor’s recent sign-in risk; a forwarding rule created right after a suspicious sign-in is an incident.