Detecting Email-Based Exfiltration and Auto-Forwarding

Email exfiltration comes in two forms. Persistent collection uses forwarding or redirect rules, a staple of business email compromise. One-off theft sends files as attachments to a personal address. Both leave clear audit trails in Exchange and Microsoft 365, provided you retain and read them.

Signals at a Glance

Forwarding Rules and Mailbox Settings

Watch the creation events, then audit the current state. Rule creation is logged as New-InboxRule or Set-InboxRule, and mailbox forwarding as Set-Mailbox. Attackers frequently pair forwarding with a hiding rule, so look at the other actions on the same rule too:

// Sentinel (KQL) - inbox rules that forward or redirect externally
// tune/validate: Parameters is a JSON array of name/value pairs in OfficeActivity
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload == "Exchange"
| where Operation in ("New-InboxRule","Set-InboxRule","UpdateInboxRules")
| extend p = tostring(Parameters)
| where p has_any ("ForwardTo","RedirectTo","ForwardAsAttachmentTo","DeleteMessage","MoveToFolder")
| project TimeGenerated, UserId, ClientIP, Operation, p
| order by TimeGenerated desc

State matters as much as events. Rules created before your retention window never appear in a log hunt, so enumerate what exists today:

# Exchange Online PowerShell - enumerate external forwarding in place
# tune/validate: run read-only under a least-privilege audit account
Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select-Object UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward

foreach ($mbx in Get-Mailbox -ResultSize Unlimited) {
  Get-InboxRule -Mailbox $mbx.UserPrincipalName |
    Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo } |
    Select-Object @{n='Mailbox';e={$mbx.UserPrincipalName}}, Name, ForwardTo, RedirectTo, ForwardAsAttachmentTo
}

Attachments and Prevention

• Alert on messages with attachments above a size threshold sent to consumer mail domains by users who rarely send external attachments.
• Block automatic external forwarding with an outbound spam policy so the control is preventive, then detect attempts to bypass it.
• Enable MailItemsAccessed auditing where licensing allows; it records which items an attacker actually read.
• Treat a forwarding rule appearing within minutes of an anomalous sign-in as an account compromise, not a user preference.