Correlate mailbox-rule creation with termination dates, then prioritise first-time forwarding actions and destinations that match personal addresses on file. A rule that appears while offboarding is already in motion is far more suspicious than the same rule created during normal employment. History and lifecycle context matter more than the rule type alone.
Why forwarding rules become suspicious during offboarding
Forwarding behaviour is risky because it often creates a quiet path for mailbox content to leave the organisation after a person’s access should be shrinking. The signal is strongest when a rule appears close to termination, especially if it forwards to an address already linked to the user. During offboarding, the same action has a very different meaning than it does during steady-state employment.
Security teams should treat mailbox-rule creation as a lifecycle event, not just an inbox configuration change. A newly created rule can be benign, but offboarding narrows the set of legitimate reasons for it. That is why the timing, destination and first-seen nature of the rule matter more than the forwarding feature itself.
Mailbox forwarding can also be used to preserve access after an employee leaves, whether intentionally or through account compromise. For practitioners, the key question is not whether forwarding exists, but whether it was introduced at a point when access should have been reviewed, reduced or removed.
Which signals separate routine mailbox management from suspicious exfiltration
The most useful triage pattern is to compare the rule’s creation time against the termination workflow and then sort for first-time forwarding actions. A first-seen forward to an external destination is materially more suspicious than a long-standing internal rule. The destination matters as well, because personal email addresses, consumer domains and addresses tied to a departing employee’s history usually deserve immediate review.
Context also helps distinguish normal delegation from risk. If the mailbox has an established pattern of forwarding for a documented business process, that is very different from a late-stage rule created after offboarding has begun. Teams should look for newness, novelty and mismatch: new rule, new recipient, and a recipient that does not fit the account’s ordinary business use.
Good detection logic usually enriches the event with HR or identity lifecycle data, because a mailbox rule by itself does not tell the whole story. The question is whether the rule is aligned with a legitimate transition, or whether it appears during a period when the user’s authority is being withdrawn. That lifecycle overlay is what turns a generic mailbox event into a security signal.
How teams should operationalise the review
Build the alert so that offboarding context changes the ranking of the event. A rule created before notice is less urgent than one created after notice, and a rule created after termination should be treated as high priority until proven otherwise. The most useful review queue is usually the one that combines rule timing, destination reputation and the user’s departure status in a single case.
Correlate mailbox-rule telemetry with identity and HR records, then validate whether the forwarding target is expected, approved and still necessary. If the target is a personal address, ask whether the mailbox was meant to be migrated through a controlled handoff instead. If the rule is external and newly created, preserve the evidence, assess for broader access misuse, and confirm whether any other mail or SaaS forwarding paths were also enabled.
Where possible, teams should pair detection with preventive controls such as mail-flow restrictions, approval gates for external forwarding and timely removal of access before the leaver window closes. The goal is not to eliminate every forwarding scenario, but to make unusual forwarding visible, reviewable and hard to abuse silently.
Risk and Threat Considerations
Forwarding rules are a common data-exfiltration path because they can preserve access even after the user should no longer be handling company mail. During offboarding, that creates a concentrated risk of unnoticed disclosure, especially when the destination is external or personally controlled.
Failure mechanism: An attacker or departing user creates a new rule just before or during offboarding, redirecting mail to an external inbox while the organisation is focused on account closure rather than message flow.
Impact: Sensitive correspondence, reset links, approvals and customer communications can leave the organisation without triggering the same visibility as a direct login compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Offboarding-linked forwarding is governed by timely account disablement and removal of residual access. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detecting suspicious forwarding depends on reviewing mailbox and lifecycle audit trails together. | |
| Recommendation — Revoke or disable leaver access before mailbox rules can persist beyond the user’s authorised period. Correlate rule-creation logs with termination events and investigate late, first-seen forwarding. | ||
| CIS Controls v8 | CIS-5 — Account Management | Offboarding forwarding is an account-lifecycle control issue requiring prompt access removal and review. |
| Recommendation — Review leaver accounts for lingering forwarding paths and remove any unnecessary external destinations. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Mailbox forwarding during offboarding depends on controlled identity lifecycle and ownership changes. |
| A.5.18 — Access rights | Suspicious forwarding often reflects access that should have been withdrawn during offboarding. | |
| Recommendation — Ensure identity transitions remove mailbox-control paths when employment ends. Revoke mailbox-related access rights as part of the leaver process and verify they are gone. | ||
Practitioner Guidance
What to prioritise: Prioritise first-time forwarding rules that appear during the offboarding window, then rank them by whether the destination is external, personal, or previously unseen in the account’s history.
What to verify: Verify the rule against the leaver workflow, recent ticketing, and any approved mailbox transfer or delegation process before assuming it is legitimate.
Decision rule: If the rule was created after termination was initiated, treat it as a potential data-loss event first and as an inbox-management issue second.
Practitioner takeaway: The best indicator is not forwarding alone, but forwarding introduced at the moment when access should be disappearing, because lifecycle timing turns an ordinary rule into a potential exfiltration path.
Related resources from NHI Mgmt Group
- How should security teams handle mailbox forwarding during offboarding?
- How should security teams handle NHIs exposed during employee offboarding?
- What do security teams get wrong about shared accounts during offboarding?
- How can security teams spot automated behaviour inside human-looking sessions?