An email forwarding rule is a mailbox setting that automatically sends copies of messages to another address. Attackers abuse it after account compromise to maintain persistence and quietly steal mail. Defenders should audit inbox rules, alert on new or changed forwarding targets, and remove unauthorised rules during incident response.
What an email forwarding rule does
An email forwarding rule is a mailbox control that can silently copy incoming messages to another address, often without the sender or user noticing. In ordinary use, it helps with continuity and routing; in a compromised mailbox, it becomes a covert exfiltration path.
The security significance is that forwarding rules operate inside the trust boundary of the mailbox itself. Once an attacker can edit inbox rules, they can move mail out of the account while the legitimate owner continues to receive normal service, making the compromise harder to spot.
How forwarding rules are abused after account compromise
Attackers commonly create or modify rules to capture password resets, invoice messages, internal approvals, and other high-value content. Because the mail flow still appears functional, the rule can support persistence, surveillance, and follow-on fraud without needing repeated interactive access.
This pattern is especially dangerous when rules forward only selected messages or when the attacker combines forwarding with delete, move, or mark-as-read actions. That combination reduces the chance that a mailbox owner will notice unusual inbox behaviour during a casual review.
Exposure checks and monitoring signals
Organisations should treat mailbox rules as part of account exposure review, not just user convenience settings. Audit the current state of inbox rules, forwarding targets, delegated access, and mailbox-level configuration whenever an account is investigated, offboarded, or recovered from suspicious activity.
Useful signals include a newly added external forwarding address, a rule created soon after a login anomaly, or mail disappearing from the inbox without a matching deletion event. Alerting on rule creation and changes is important because a forwarding rule can be the first durable indicator that a mailbox has been taken over.
For broader detection and response coverage, align the review with the kind of access, audit, and configuration controls described in NIST SP 800-53 Rev 5 Security and Privacy Controls and the account-control focus of NIST Cybersecurity Framework 2.0.
Remediation and response after a malicious rule is found
Once a malicious rule is identified, remove it, confirm whether the attacker created any additional mailbox changes, and review messages that may already have been forwarded externally. The rule itself is often only one artifact of compromise, so recovery should include the account, the authentication path, and any sessions that were active when the rule was created.
Mailbox recovery should also examine whether the attacker changed recovery details, added alternate forwarding paths, or planted secondary persistence mechanisms such as delegation or app access. For a practical baseline on credentialed access and mailbox hardening, OWASP Non-Human Identity Top 10 is useful where mailbox automation, service accounts, or other non-human actors are part of the email workflow.
If the investigation shows the mailbox was used to access secrets, approvals, or authentication codes, rotate any affected credentials and review downstream accounts that may have been reset through email. That is often the point at which a simple inbox compromise turns into wider identity compromise.
Risk and Threat Considerations
Email forwarding rules create a low-friction persistence mechanism because they exploit a legitimate mailbox feature rather than a separate malware foothold. That makes them attractive for stealthy exfiltration, especially when the attacker wants ongoing visibility into business mail or password reset traffic.
Failure mechanism: The attacker gains mailbox control, creates or alters a forwarding rule, and uses routine mail delivery to siphon sensitive messages while staying inside normal user-visible behaviour.
Impact: Confidential mail can leak for days or weeks, password reset flows can be intercepted, and the mailbox can remain a hidden pivot point for follow-on account takeover or fraud.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Forwarding-rule changes are audit events that need review and alerting. |
| AC-6 — Least Privilege | Attackers abuse mailbox settings only when they can alter forwarding rules. | |
| Recommendation — Review mailbox-rule events and alert on unusual forwarding changes. Limit who can change mailbox rules and forwarding settings. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and Systems Monitored to Detect Potentially Adverse Events | Mailbox-rule creation and modification are monitorable adverse events. |
| RS.MA-01 — Response Plan Executed | Removal of malicious forwarding rules is part of incident handling. | |
| Recommendation — Monitor mailbox configuration changes for suspicious forwarding activity. Execute the response plan to remove malicious rules and recover the account. | ||
| MITRE ATT&CK | T1114.003 — Email Collection: Email Forwarding Rule | This technique directly describes attacker use of forwarding rules for email collection. |
| Recommendation — Map observed mailbox-rule abuse to T1114.003 and investigate related persistence. | ||
Practitioner Guidance
What to watch for: Treat any unexpected forwarding target, especially an external address, as a high-priority account event. Rules that move, delete, or auto-forward selected messages deserve the same attention as explicit login anomalies because they often indicate post-compromise persistence.
Governance implication: Mailbox rule management should be part of incident response and periodic access review, not an informal user setting. Where policy allows forwarding for business reasons, keep approvals narrow, time-bound, and easy to audit.
Practitioner takeaway: The safest assumption is that a forwarding rule may already be part of an intrusion, so review it as both a control issue and an indicator of compromise.
Related resources from NHI Mgmt Group
- Who is accountable when a departing employee leaves a forwarding rule in place?
- What breaks when email security relies too heavily on rule based filtering in K-12 districts?
- What are the signs that rule-based email security is failing against socially engineered attacks?
- What breaks when agencies rely on rule-based email defenses against modern account takeover attacks?