Navigation :

O365 Suspicious Admin Email Forwarding

Description

This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.

Content Mapping

This content is not mapped to any local saved search. Add mapping

Use Case

Security Monitoring

Alert Volume

This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.

SPL Difficulty

None

Journey

Stage 1

MITRE ATT&CK Tactics

Collection

MITRE ATT&CK Techniques

Email Collection

Email Forwarding Rule

Data Sources

Search
`o365_management_activity` Operation=Set-Mailbox \| spath input=Parameters \| rename Identity AS src_user \| search ForwardingAddress=* \| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress \| where count_src_user > 1 \|`security_content_ctime(firstTime)` \|`security_content_ctime(lastTime)` \|`o365_suspicious_admin_email_forwarding_filter` Open in Search

Search

`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_admin_email_forwarding_filter`

Open in Search