T1114.003 — Email Forwarding Rule

Tactic: Collection · Platforms: Linux, macOS, Office Suite, Windows

Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or…

Sub-technique of Email Collection (T1114).

Sigma detection rules (4)

T1114.003 Email Collection: Email Forwarding Rule

title: "T1114.003 Email Collection: Email Forwarding Rule"
id: e6a35e87-8302-42b7-a5e6-d6e2b7044b63
description: 'Detects PowerShell/Exchange cmdlets creating/modifying mailbox forwarding rules. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: UserContext, TimeWindow, TargetMailbox.'
references:
  - https://attack.mitre.org/techniques/T1114/003
author: Shahrukh Khan
date: 2026-04-14
license: MIT
tags:
  - attack.collection
  - attack.t1114.003

logsource:
  category: process_creation
  product: windows

detection:
  selection_cmdlet:
    EventID: '4688'
    CommandLine|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
      - 'Set-Mailbox'
  selection_forward_param:
    CommandLine|contains:
      - '-ForwardTo'
      - '-ForwardingSmtpAddress'
      - '-RedirectTo'
      - '-DeliverToMailboxAndForward'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_cmdlet and selection_forward_param and not filter_system_account

falsepositives:
  - Legitimate mailbox migration/forwarding by IT.

level: medium

T1114.003 Email Collection: Email Forwarding Rule

title: "T1114.003 Email Collection: Email Forwarding Rule"
id: f85ee6ba-4da6-4323-b769-356be67eb132
description: 'Email Forwarding Rule Abuse Detection Across Platforms. (Retargeted to the file_change auditd telemetry that actually captures this technique''s behavior; see logsource below.) Matches PATH records for /.forward with nametype CREATE or NORMAL so a newly-planted forwarding file is caught, not only modifications to an existing one. Tune using: .forwardPath, ExecContext.'
references:
  - https://attack.mitre.org/techniques/T1114/003
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.collection
  - attack.t1114.003

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    name|endswith: '/.forward'
    nametype:
      - NORMAL
      - CREATE

  condition: selection

falsepositives:
  - 'Users legitimately configure .forward files for personal mail-forwarding preferences, including first-time creation; scope to service/privileged account home directories where forwarding rules are unexpected.'

level: high

T1114.003 Email Collection: Email Forwarding Rule

title: "T1114.003 Email Collection: Email Forwarding Rule"
id: ecf17b8c-b93c-4e05-9e67-354d3e6f3296
description: 'Email Forwarding Rule Abuse Detection Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RuleFilePath, ScriptTrigger.'
references:
  - https://attack.mitre.org/techniques/T1114/003
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
  - attack.collection
  - attack.t1114.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
      - 'tell application "Mail"'
      - 'rule'

  condition: selection

falsepositives:
  - Users legitimately scripting new Mail.app rules for personal organization.

level: high

T1114.003 Email Collection: Email Forwarding Rule

title: "T1114.003 Email Collection: Email Forwarding Rule"
id: bd557120-9b9c-46db-98e6-3ec5b5b92945
description: 'Email Forwarding Rule Abuse Detection Across Platforms. (Data Component: Cloud Service Metadata; baseline tier: fallback.) Tune using: ForwardingSMTPAddress, ActorId.'
references:
  - https://attack.mitre.org/techniques/T1114/003
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.collection
  - attack.t1114.003

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
      - 'Set-Mailbox'
  forwarding:
    Parameters|contains:
      - 'ForwardTo'
      - 'ForwardingSmtpAddress'
      - 'RedirectTo'

  condition: selection and forwarding

falsepositives:
  - Legitimate mailbox forwarding configured for role transitions, shared team inboxes, or third-party assistant coverage.

level: high

Related sub-techniques

Explore