Security teams detect email forwarding rules by reviewing mailbox and tenant audit logs, then comparing them with approved business needs. Suspicious signs include forwarding to external domains, rules that hide or delete messages, and changes made soon after credential compromise. Teams should alert on new or modified forwarding settings, especially for privileged or high-value accounts.
What forwarding rules tell you about mailbox compromise
Email forwarding rules are less about mail convenience and more about control over message flow. When a rule sends messages outside the tenant, hides messages from the inbox, or silently deletes them, it can turn a mailbox into a low-visibility relay for fraud, surveillance, or business email compromise. Teams should treat rule review as part of both mailbox abuse detection and post-authentication compromise checks.
Forwarding rules matter because they can persist after the initial login event. An attacker who has gained access may use rules to keep receiving mail, suppress warnings, and monitor conversations without triggering obvious user complaints. That is why forward-to-external behavior, hidden folders, and message-deletion actions are stronger signals than the mere existence of a rule.
For readers building a broader email-defense program, the Email Identity and BEC Guide covers the rule patterns and mailbox abuse paths that commonly accompany impersonation and takeover events.
How to review logs and spot suspicious rule changes
The most reliable method is to combine mailbox audit logs with tenant-level activity and compare what changed against the account’s expected behavior. Look for rule creation, modification, or deletion events, then verify whether the destination, action, and timing make sense for that user and role. A new rule is especially suspicious when it appears shortly after a password reset, MFA reset, consent grant, or other sign of compromise.
Good triage starts with three questions: who changed the rule, what mailbox action it performs, and where the mail now goes. External forwarding is the clearest red flag, but internal forwarding to an unfamiliar mailbox can also be abusive if it bypasses normal business processes. Teams should also look for rules that apply only to messages from executives, finance, or cloud providers, because selective targeting often indicates credential theft or fraud preparation.
When the mailbox estate is large, it helps to baseline normal rule usage and then alert on exceptions. That includes newly added auto-forwarding, rule edits that add deletion or archiving actions, and changes made from unfamiliar geographies or devices. The objective is not to inspect every rule manually, but to surface the small set of changes that are most likely to indicate loss of control.
For operational teams comparing detection options and mailbox telemetry sources, the Email Security Guide provides a useful architecture view of where post-delivery and tenant-side controls fit.
What to investigate first when forwarding looks malicious
Once a suspicious rule is found, the first investigation step is to determine whether the mailbox was actually compromised or whether the rule was created for an approved workflow. That means checking sign-in history, recent consent grants, inbox access behavior, and any mailbox delegation changes around the same time. A rule that was created by a legitimate helpdesk action has a very different meaning from one created after impossible travel, legacy-authentication use, or a burst of failed logins.
Then verify whether the rule is still active, whether it has already forwarded sensitive mail, and whether the attacker used the mailbox to reach other systems. If the account is privileged or handles payments, legal, HR, or executive correspondence, treat the mailbox as a high-value access point rather than a simple user inbox. In those cases, message forwarding may be only one part of a wider compromise path.
If remediation is delayed, the key decision is whether to disable the rule immediately or preserve it for evidence collection. In most cases, containment comes first, because ongoing forwarding continues to leak communications while you investigate. Preserve the relevant logs and the rule definition before making changes so you can later reconstruct the sequence of events.
For practitioners who want a vendor-neutral way to frame mailbox abuse and detection coverage, the Email Security Buyer’s Guide is useful when you need to compare how different products surface forwarding and post-delivery abuse.
Risk and Threat Considerations
Unauthorized forwarding rules create a low-noise exfiltration path because they exploit normal mail delivery behavior rather than a noisy malware action. That makes them attractive after mailbox compromise, especially when the attacker wants to read business conversations, intercept one-time approvals, or hide from the victim while maintaining access.
Failure mechanism: The attacker changes mail flow at the mailbox or tenant layer, then uses forwarding, hiding, or deletion logic to keep receiving sensitive messages while reducing the chance that the user notices abnormal inbox activity.
Impact: Confidential mail can be exposed for as long as the rule remains active, and the mailbox may continue to support fraud, impersonation, or follow-on compromise even after the initial login is remediated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1114 — Email Collection | Forwarding rules redirect mail for attacker access and collection. |
| Recommendation — Detect mailbox forwarding used to collect messages and alert on suspicious rule changes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Mailbox forwarding abuse depends on account-level control and review of authorized access paths. |
| Recommendation — Review and revoke unauthorized mailbox access paths, including forwarding rules. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Mailbox and tenant logs are the primary evidence for detecting suspicious forwarding changes. |
| AC-6 — Least Privilege | Forwarding from high-value accounts increases exposure when access exceeds business need. | |
| Recommendation — Monitor audit logs for new or modified forwarding rules and investigate exceptions. Limit forwarding capability to approved roles and restrict high-value mailboxes. | ||
Practitioner Guidance
What to verify: Confirm whether the forwarding target is approved, whether the rule was created during a known support action, and whether the mailbox shows concurrent signs of compromise such as suspicious sign-ins or consent grants. A rule is more concerning when it combines external forwarding with hiding or deletion.
Decision rule: If the mailbox can receive regulated, financial, executive, or privileged correspondence, treat unexplained forwarding as a containment issue first and an investigation issue second. If the rule is tied to a known business process, document the justification and keep monitoring for drift.
Practitioner takeaway: The useful question is not whether forwarding exists, but whether it changes who can read the mailbox without the owner’s knowledge or approval.