Detectionlowtest

Suspicious Inbox Forwarding

Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin SongerCreated Sun Aug 22Updated Sun Oct 096c220477-0b5b-4b25-bb90-66183b4089e8cloud

Log Source

Microsoft 365threat_management

ProductMicrosoft 365← raw: m365

Servicethreat_management← raw: threat_management

Detection Logic

detection:
    selection:
        eventSource: SecurityComplianceCenter
        eventName: 'Suspicious inbox forwarding'
        status: success
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0010 · Exfiltration

Techniques