Agent Foskett Academy • KQL Academy • Module 13 • Lesson 157 • Cloud & SaaS Investigation

Lesson 157 — The Mailbox Started Forwarding Messages Externally

Lesson 156 found a suspicious inbox rule created during the compromise timeline. Now we follow the consequence.

Exchange and Defender telemetry show messages associated with the mailbox leaving the organisation for an external recipient. In this lesson we use KQL to identify the forwarding destination, compare the activity with the rule configuration, establish whether external message flow is normal for the mailbox and determine whether the rule resulted in actual message redirection.

A forwarding rule shows intent or configuration. External message flow shows what actually happened.

Begin the Investigation Back to KQL Academy

Agent Foskett KQL Academy Exchange external forwarding investigation

Your case file

Shortly after the inbox rule appears, messages from alex.wilson@contoso.com begin reaching a recipient outside contoso.com.

✓ Identify forwarding destinations

✓ Confirm external message flow

✓ Compare with mailbox baseline

✓ Correlate rule creation and delivery

Case briefing

CASE FILE Mailbox: alex.wilson@contoso.com 15:22 — new inbox rule created ↓ 15:28 — first external message observed ↓ 15:31–16:02 — repeated external deliveries ↓ Destination: external recipient under investigation ↓ THE QUESTION Did the inbox rule merely exist, or did it actually redirect organisational mail outside the tenant?

Investigation objective

Use Exchange audit and Defender email telemetry to identify external forwarding destinations, confirm message flow to those recipients, compare the behaviour with historical patterns and determine whether mailbox content was actually redirected outside the organisation.

Investigator's rule

Configuration and outcome are different evidence questions. A forwarding rule may be suspicious, but the stronger finding comes from proving that messages were delivered to the configured destination.

Stage 1 — recover the forwarding destination from the rule

Return to the inbox-rule audit event and extract forwarding or redirect targets from the rule parameters.

1234567891011121314151617

let TargetMailbox = "alex.wilson@contoso.com";
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload == "Exchange"
| where UserId =~ TargetMailbox
| where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| mv-expand Parameter = Parameters
| extend ParameterName = tostring(Parameter.Name),
         ParameterValue = tostring(Parameter.Value)
| where ParameterName has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo")
| project TimeGenerated,
          UserId,
          Operation,
          ParameterName,
          ParameterValue,
          ClientIP
| order by TimeGenerated asc

Validate the destination

Determine whether the recipient is internal, external, approved, known to the user or associated with a legitimate business workflow before describing it as unauthorised.

Keep the original rule event

The extracted destination is convenient for hunting, but preserve the full audit record and parameters for reporting and validation.

Stage 2 — inspect messages associated with the mailbox

Use EmailEvents to review mail associated with the mailbox and identify deliveries that may correspond with forwarding activity.

1234567891011121314

let TargetMailbox = "alex.wilson@contoso.com";
EmailEvents
| where Timestamp > ago(7d)
| where SenderFromAddress =~ TargetMailbox
| project Timestamp,
          NetworkMessageId,
          SenderFromAddress,
          RecipientEmailAddress,
          RecipientObjectId,
          DeliveryAction,
          DeliveryLocation,
          Subject,
          ThreatTypes
| order by Timestamp asc

Message telemetry adds outcome evidence

Rule configuration tells us what Exchange was instructed to do. Message telemetry can help establish whether messages actually reached another recipient.

Preserve NetworkMessageId

NetworkMessageId is a valuable pivot for following the same message through related Defender email records and delivery evidence.

Stage 3 — isolate external recipients

Extract recipient domains and focus on destinations outside the organisation's accepted domain. Summarise how many messages each external recipient received.

1234567891011121314

let TargetMailbox = "alex.wilson@contoso.com";
EmailEvents
| where Timestamp > ago(7d)
| where SenderFromAddress =~ TargetMailbox
| extend RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
| where isnotempty(RecipientDomain)
| where RecipientDomain !~ "contoso.com"
| summarize Messages=count(),
            FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp),
            MessageIds=make_set(NetworkMessageId, 50),
            Subjects=make_set(Subject, 50)
          by RecipientEmailAddress, RecipientDomain
| order by Messages desc

External does not mean malicious

Users legitimately send email outside their organisation every day. The key question is whether the recipient matches the suspicious forwarding rule and whether the message pattern began after compromise.

Count and content both matter

A handful of externally delivered messages and a sustained stream of sensitive correspondence have different implications. Preserve subjects and message IDs as pivots, while handling message content according to organisational policy.

Stage 4 — establish the mailbox's external-mail baseline

Look back across the previous 30 days and compare the mailbox's normal external-message volume with the incident period.

123456789

let TargetMailbox = "alex.wilson@contoso.com";
EmailEvents
| where Timestamp > ago(30d)
| where SenderFromAddress =~ TargetMailbox
| extend RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
| summarize ExternalMessages=countif(RecipientDomain !~ "contoso.com"),
            TotalMessages=count()
          by bin(Timestamp, 1d)
| order by Timestamp asc

Baseline helps with abnormality

If the mailbox regularly communicates externally, the mere existence of external recipients is unsurprising. The destination, timing and sudden change in volume become more important.

New destination is useful context

A previously unseen external address that appears immediately after a suspicious rule change can substantially strengthen the forwarding hypothesis.

Stage 5 — correlate rule creation with external delivery

Bring the Exchange rule event and externally delivered messages into one timeline. This tests whether the forwarding outcome follows the configuration change in a defensible sequence.

1234567891011121314151617181920212223242526272829

let TargetMailbox = "alex.wilson@contoso.com";
let StartTime = datetime(2026-08-18 15:15:00);
let EndTime = datetime(2026-08-18 16:15:00);
union
(
    OfficeActivity
    | where TimeGenerated between (StartTime .. EndTime)
    | where OfficeWorkload == "Exchange"
    | where UserId =~ TargetMailbox
    | where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
    | project TimeGenerated,
              EvidenceType="Inbox rule",
              Activity=Operation,
              Source=ClientIP,
              Detail=tostring(Parameters)
),
(
    EmailEvents
    | where Timestamp between (StartTime .. EndTime)
    | where SenderFromAddress =~ TargetMailbox
    | extend RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
    | where RecipientDomain !~ "contoso.com"
    | project TimeGenerated=Timestamp,
              EvidenceType="External mail",
              Activity=DeliveryAction,
              Source=RecipientEmailAddress,
              Detail=strcat(Subject, " | ", DeliveryLocation)
)
| order by TimeGenerated asc

Time order matters

If external deliveries begin only after the rule appears and match its destination, the relationship becomes much stronger than two unrelated events observed somewhere in the same day.

The destination becomes a new entity

Once the recipient is confirmed, pivot on that address across other mailboxes, incidents and message telemetry to determine whether the same destination appears elsewhere.

Agent Foskett's forwarding timeline

15:22 Inbox rule created ↓ FORWARD / REDIRECT DESTINATION extracted from Parameters ↓ 15:28 First external message observed ↓ NETWORKMESSAGEID preserved for correlation ↓ 15:31–16:02 Repeated deliveries to same destination ↓ 30-DAY BASELINE recipient not normally seen ↓ RULE + MESSAGE FLOW chronologically correlated ↓ ASSESSMENT Mailbox content was redirected externally Scope and sensitivity still require investigation

The inbox rule raised the suspicion. The external deliveries turned it into an outcome.

Your evidence board

Evidence	What it supports	Weight
Rule contains external forward or redirect destination	Shows Exchange was configured to send mail elsewhere.	Strong configuration evidence
External deliveries begin after the rule is created	Supports a temporal relationship between rule and outcome.	Strong
Delivery recipient matches rule destination	Directly connects configuration to message flow.	Very strong
Recipient absent from historical baseline	Shows the destination is unusual for the mailbox.	Strong supporting evidence
Repeated deliveries over time	Supports sustained rather than one-off redirection.	Strong
External messages alone	Do not prove they were generated by malicious forwarding.	Insufficient alone

Write the finding like an investigator

Example: Exchange Online audit telemetry identified an inbox rule for alex.wilson@contoso.com configured with an external forwarding or redirect destination. Defender email telemetry subsequently recorded messages associated with the mailbox reaching an external recipient after the rule-creation time. The destination, message timestamps and available identifiers were correlated with the rule configuration and compared with the mailbox's historical external-message pattern. The observed sequence supports the conclusion that organisational mail was redirected externally after the suspicious mailbox configuration change. Further investigation should determine the number and sensitivity of affected messages, whether the destination was authorised, and whether the same recipient appears in other mailboxes or incidents.

Lesson 157 key takeaways

Recover forwarding and redirect destinations from Exchange inbox-rule audit data.
Use EmailEvents to investigate actual message delivery outcomes.
Preserve NetworkMessageId for message-level correlation.
Separate rule configuration from actual external delivery.
External recipients can be legitimate, so validate the destination.
Historical mailbox behaviour helps determine whether the recipient or volume is unusual.
A recipient matching the configured rule destination strongly connects configuration to outcome.
Chronology strengthens the relationship between rule creation and forwarding.
Confirmed external forwarding does not by itself establish the sensitivity of the exposed mail.
Use the external destination as a pivot across other mailboxes and incidents.

Module 13 — the investigation moves from mail to files

Lesson 156 found the suspicious inbox rule. Lesson 157 now confirms that messages began reaching an external destination. Next, the investigation pivots back into cloud data, where the same account shares a sensitive file outside the organisation.

Next: Lesson 158 — The Account Shared a Sensitive File Outside the Organisation.

Continue your KQL investigation training

Module 13 follows users, sessions, applications and data through Microsoft 365 and cloud services.

KQL Academy Lesson 156 — A New Inbox Rule Appeared After the Sign-In Microsoft Sentinel Academy Agent Foskett Academy

🔎 KQL Academy — Module 13: Advanced Cloud & SaaS Investigation

Following users, sessions, applications and data through Microsoft 365 and cloud services.

⬅ Previous lesson

Lesson 156 — A New Inbox Rule Appeared After the Sign-InInvestigate suspicious inbox-rule creation and its actions.

✅ Current lesson

Lesson 157 — The Mailbox Started Forwarding Messages ExternallyConfirm whether the mailbox actually redirected messages to an external destination.

Next lesson

Lesson 158 — The Account Shared a Sensitive File Outside the OrganisationInvestigate external sharing and determine whether sensitive organisational data was exposed beyond the tenant.

Investigate external mailbox forwarding with KQL

Lesson 157 of the Agent Foskett KQL Academy uses Exchange Online audit and Microsoft Defender email telemetry to investigate mailbox forwarding to external recipients.

Correlate inbox rules with external message delivery

Learn how to recover forwarding destinations, identify actual external deliveries, compare mailbox behaviour with historical baselines and determine whether a suspicious inbox rule resulted in organisational mail leaving the tenant.