Test Detection for Microsoft 365 – Inbox Forwarding Rule

Microsoft 365 Inbox Forwarding Rule

The creation of an Microsoft 365 inbox rule is often a technique used to exfiltrate email that is often used for recon purposes in a staged attack. By monitoring for new inbox rule creation, you can have immediate awareness of what could be a malicious activity.

How to Test Office365 Inbox Forwarding Rule

Prerequisites:

Office 365 module is configured and properly logging to Blumira

Testing Steps:

Sign in to office365 email account in Outlook
Navigate to Settings > View all Outlook settings
Mail > Forwarding > Enable forwarding > add forwarding email address > Click Save
Within minutes, a finding (alert) appears within the Blumira responder dashboard

Additional Security Resources

View All Posts

Product Updates

6 min read | July 22, 2024

Detect and Respond to Azure Threats With Blumira: Easy Cloud SIEM Setup

Security Trends and Info

5 min read | April 26, 2024

Detecting and Preventing Ransomware Attacks in Microsoft Environments

Security Alerts

8 min read | April 19, 2024

Why are Threat Actors enabling Windows Restricted Admin mode?

Get Started for Free

Experience the Blumira Free SIEM, with automated detection and response plus compliance reports for 3 cloud connectors, forever.