Detecting Suspicious Microsoft 365 Inbox Forwarding Rules Using OfficeActivity

In Business Email Compromise (BEC) intrusions, attackers who compromise executive or finance mailboxes immediately create hidden forwarding rules. These rules divert financial statements, invoices, and sensitive negotiations to an external adversary-controlled inbox while bypassing user suspicion.

Here is how to catch these rules within minutes of creation using Microsoft Sentinel.

Required Log Source

• Microsoft Sentinel with Office 365 Exchange Online log connector enabled.

KQL Detection Query for Mail Forwarding

// Detect Creation or Update of Inbox Rules Forwarding Mail Outside the Organization
let timeRange = 7d;
OfficeActivity
| where TimeGenerated >= ago(timeRange)
| where RecordType in ("ExchangeAdmin", "ExchangeItem")
| where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| extend Parameters = parse_json(Parameters)
| mv-expand Parameters
| extend ParamName = tostring(Parameters.Name),
         ParamValue = tostring(Parameters.Value)
| where ParamName in~ ("ForwardTo", "ForwardingSmtpAddress", "RedirectTo")
| where isnotempty(ParamValue)
// Filter for external forwarders (excluding corporate domain)
| where not(ParamValue endswith "@yourcompany.com") // Replace with your enterprise domain
| project TimeGenerated, UserId, ClientIP, Operation, ParamName, ParamValue
| order by TimeGenerated desc

Threat Triage

1. Check the ClientIP and geographic location where the rule was created.
2. Confirm with the mailbox owner if they authorized external forwarding.
3. Review SigninLogs for the UserId around the same timestamp to inspect for sign-in anomalies or MFA bypass.

MITRE ATT&CK Mapping

• Tactic: Collection (TA0009), Exfiltration (TA0010)
• Technique: Email Collection: Email Forwarding Rule (T1114.003)