Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)

Hunt Hypothesis

This hypothesis targets adversaries who establish persistent email forwarding rules to exfiltrate sensitive data to external domains, a technique that often bypasses standard outbound traffic monitoring. Proactively hunting for these patterns in Azure Sentinel allows the SOC to identify hidden data exfiltration channels before they are leveraged for large-scale data theft or lateral movement.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Outbound" and isnotempty(ForwardingInformation)
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend FwdInfo = parse_json(ForwardingInformation)
| extend ForwardingType = tostring(FwdInfo.ForwardingType),
         ForwardingUser = tostring(FwdInfo.ForwardingUser),
         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])
| summarize ForwardedMessages = count(),
            ForwardingUsers = dcount(ForwardingUser)
    by RecipientDomain, ForwardingType
| top 20 by ForwardedMessages

Analytic Rule Definition

id: a5736802-3a1c-40aa-8e8f-7fbdaa52ae65
name: Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)
description: |
  This query lists the top external domains receiving automatically forwarded email, by forwarding type, using the EmailEvents table.
description-detailed: |
  Auto-forwarding to external domains is a common data-exfiltration technique after mailbox compromise. This query ranks the external recipient domains receiving auto-forwarded mail, split by forwarding type (mailbox rule versus SMTP forwarding), with the count of forwarded messages and the distinct internal forwarding users. Unfamiliar or personal-webmail domains receiving high volumes are worth investigating.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - Collection
  - Exfiltration
relevantTechniques:
  - T1114
  - T1020
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Outbound" and isnotempty(ForwardingInformation)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend FwdInfo = parse_json(ForwardingInformation)
  | extend ForwardingType = tostring(FwdInfo.ForwardingType),
           ForwardingUser = tostring(FwdInfo.ForwardingUser),
           RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])
  | summarize ForwardedMessages = count(),
              ForwardingUsers = dcount(ForwardingUser)
      by RecipientDomain, ForwardingType
  | top 20 by ForwardedMessages
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: Collection
• Tactic: Exfiltration
• Technique: T1114 — T1114
• Technique: T1020 — T1020

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/Top External Domains Receiving Auto-forwarded Email.yaml)

False Positive Guidance

• Scenario: A legacy on-premises Exchange server or third-party mail gateway (e.g., Proofpoint, Mimecast) configured with a global transport rule that automatically forwards all incoming mail to an external backup or archival service (e.g., archive.corp-backup.com).
  • Filter/Exclusion: Exclude domains associated with known internal backup or archival vendors, or filter out events where the MailboxType is SharedMailbox or ResourceMailbox if the forwarding is system-generated rather than user-initiated.
• Scenario: A shared mailbox for a specific department (e.g., sales@company.com) has a user-created rule that auto-forwards all emails to an external partner or client domain (e.g., partner-client.com) for collaborative project management.
  • Filter/Exclusion: Exclude specific shared mailboxes that are documented as having external forwarding permissions, or filter out events where the Sender is a shared mailbox and the RecipientDomain is on a pre-approved list of partner domains.
• Scenario: An automated IT ticketing system (e.g., ServiceNow, Jira) uses an SMTP relay to forward support emails from a dedicated alias (e.g., support@company.com) to an external vendor’s intake domain (e.g., vendor-support-intake.com) for SLA tracking.
  • Filter/Exclusion: Exclude domains that are part of the IT vendor management list, or filter out events where the Mailbox name matches known service aliases (e.g., support, helpdesk, billing) and the forwarding type is SMTP (indicating system-generated rather than user-rule-based).
• Scenario: A finance team uses a shared mailbox for accounts payable that auto-forwards invoices to an external OCR processing service (e.g., ocr-service.provider.com) for digitization