Suspicious Inbox Forwarding Identity Protection
Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address
Sigma rule (View on GitHub)
1title: Suspicious Inbox Forwarding Identity Protection
2id: 27e4f1d6-ae72-4ea0-8a67-77a73a289c3d
3status: test
4description: Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address
5references:
6 - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding
7 - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
8author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
9date: 2023-09-03
10tags:
11 - attack.t1114.003
12 - attack.collection
13logsource:
14 product: azure
15 service: riskdetection
16detection:
17 selection:
18 riskEventType: 'suspiciousInboxForwarding'
19 condition: selection
20falsepositives:
21 - A legitimate forwarding rule.
22level: high
References
Related rules
- Email Forwarding Rule - Suspicious Folders
- Email Forwarding Rule - Suspicious Forwarding Criteria
- Email Forwarding Rule - Suspicious Rule Names
- Potential Data Stealing Via Chromium Headless Debugging
- Disk Image Mounting Via Hdiutil - MacOS