Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)

Hunt Hypothesis

This hypothesis targets adversaries leveraging mailbox auto-forwarding rules to exfiltrate sensitive data via SMTP, a technique that often bypasses standard DLP controls by routing messages directly to external addresses. Proactively hunting for this behavior in Azure Sentinel is critical because it reveals persistent, low-noise data exfiltration channels that can remain undetected until significant information has already been leaked to threat actors.

KQL Query

EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Outbound" and isnotempty(ForwardingInformation)
| extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
| summarize arg_max(Timestamp, *) by Key
| extend FwdInfo = parse_json(ForwardingInformation)
| extend ForwardingType = tostring(FwdInfo.ForwardingType),
         ForwardingUser = tostring(FwdInfo.ForwardingUser),
         RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])
| where isnotempty(ForwardingUser)
| summarize ForwardedMessages = count(),
            ExternalRecipients = dcount(RecipientEmailAddress),
            ExternalDomains = dcount(RecipientDomain)
    by ForwardingUser, ForwardingType
| top 20 by ForwardedMessages

Analytic Rule Definition

id: af562a0f-9a03-4575-b408-b8e87d71e78f
name: Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)
description: |
  This query lists the top internal users automatically forwarding email to external addresses, by forwarding type, using the EmailEvents table.
description-detailed: |
  A compromised mailbox is often configured to automatically forward mail to an external address to exfiltrate data. This query ranks the internal users auto-forwarding outbound mail to external recipients, split by forwarding type (mailbox rule versus SMTP forwarding), with the count of forwarded messages and the distinct external recipients and domains per user. High-volume or unexpected forwarders are candidates for investigation.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - Collection
  - Exfiltration
relevantTechniques:
  - T1114
  - T1020
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Outbound" and isnotempty(ForwardingInformation)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend FwdInfo = parse_json(ForwardingInformation)
  | extend ForwardingType = tostring(FwdInfo.ForwardingType),
           ForwardingUser = tostring(FwdInfo.ForwardingUser),
           RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])
  | where isnotempty(ForwardingUser)
  | summarize ForwardedMessages = count(),
              ExternalRecipients = dcount(RecipientEmailAddress),
              ExternalDomains = dcount(RecipientDomain)
      by ForwardingUser, ForwardingType
  | top 20 by ForwardedMessages
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: Collection
• Tactic: Exfiltration
• Technique: T1114 — T1114
• Technique: T1020 — T1020

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/Top Users Auto-forwarding Email Externally.yaml)

False Positive Guidance

• Shared Mailbox Auto-Forwarding for Ticketing Systems

  • Scenario: A shared mailbox (e.g., support@company.com) has an auto-forwarding rule configured to send incoming emails to a third-party helpdesk platform (e.g., Zendesk, Jira Service Management, or Freshdesk) via an external SMTP relay or direct external address. This is a standard integration pattern for IT service management.
  • Filter/Exclusion: Exclude mailboxes where the MailboxType is “Shared” or where the user object has a specific tag/attribute (e.g., IsSharedMailbox = True). Alternatively, exclude known external domains associated with ticketing platforms (e.g., *.zendesk.com, *.jira.com).

• Legacy Application SMTP Relay for Notifications

  • Scenario: An internal application server (e.g., a CI/CD pipeline like Jenkins or GitLab, or a monitoring tool like Nagios/Zabbix) uses a generic internal service account (e.g., svc-notifications@company.com) to send automated alerts or build results to external stakeholders or partner teams via an external SMTP gateway. The rule interprets this high-volume external sending as “auto-forwarding.”
  • Filter/Exclusion: Exclude service accounts identified by naming conventions (e.g., usernames starting with svc-, app-, or bot-). Additionally, correlate with the MessageClass or Subject lines containing keywords like “Build,” “Alert,” or “Notification” if the rule supports subject-based filtering.

• Executive Assistant Delegation with External Partners

  • Scenario: An executive assistant’s mailbox has a legitimate auto-forwarding rule set up to forward specific categories of email (e.g., “Vendor Invoices” or “Partner Updates”) to a trusted external partner or vendor representative for rapid response.