T1114.003 Email Forwarding Rule
Sub-technique of T1114 Email Collection
Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Suspicious Inbox Forwarding Identity Protectionhightest · azure
- Google Workspace Out Of Domain Email Forwardingmediumexperimental · gcp
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.