Lesson 48 — The Mailbox Started Forwarding Externally
The suspicious inbox rule had already changed the investigation.
Then another mailbox setting appeared in the evidence.
Messages were being sent to an address outside the organisation.
That raised a different set of questions.
Was this a legitimate forwarding configuration?
Had the user created it?
Was every future message being copied externally?
Agent Foskett now had to determine how the forwarding was configured, when it began, and what information may have left the mailbox.
The mailbox was sending data somewhere else
Identify the forwarding mechanism, destination, creation time and relationship to the suspected compromise.
Case briefing
Investigation objective
Identify suspicious external forwarding, determine the configuration method and destination, correlate the change with the compromise timeline and assess the potential exposure of mailbox content.
Investigator's rule
“The mailbox is forwarding” is not yet a complete finding. Establish the mechanism, destination, timing and scope before deciding what the forwarding means.
Stage 1 — know that forwarding can exist in different places
| Mechanism | What the analyst should investigate |
|---|---|
| Inbox rule | Rule conditions and actions that forward or redirect selected messages. |
| Mailbox forwarding setting | A mailbox-level forwarding address configured for incoming mail. |
| Mail-flow configuration | Organisation-level transport or routing logic that may affect message delivery. |
Do not search only for inbox rules
Lesson 47 investigated rule-based manipulation. External forwarding can also be configured elsewhere, so the analyst must identify the actual mechanism rather than assuming every forwarding incident is an inbox-rule incident.
Mechanism changes the scope
A rule might affect only messages matching certain conditions. A mailbox-level forwarding configuration may affect a much broader set of incoming messages.
Stage 2 — hunt for forwarding-related mailbox changes
CloudAppEvents
| where Timestamp > ago(7d)
| where AccountId =~ "alex@contoso.com"
| where ActionType in ("Set-Mailbox", "New-InboxRule", "Set-InboxRule")
| project Timestamp,
AccountId,
ActionType,
IPAddress,
UserAgent,
RawEventData
| order by Timestamp asc
Preserve the audit event
The operation name tells you what changed. The event details help establish which parameters were changed and whether a forwarding destination was involved.
Search around the known compromise
Start with the phishing and identity timeline. A forwarding change shortly after suspicious authentication deserves immediate attention, but still needs supporting evidence.
Stage 3 — inspect the changed parameters
CloudAppEvents
| where Timestamp > ago(7d)
| where AccountId =~ "alex@contoso.com"
| where ActionType == "Set-Mailbox"
| extend EventDetails = tostring(RawEventData)
| where EventDetails has_any ("ForwardingAddress",
"ForwardingSmtpAddress",
"DeliverToMailboxAndForward")
| project Timestamp,
IPAddress,
UserAgent,
EventDetails
| order by Timestamp asc
Identify the destination
The forwarding address is an important entity. Record it exactly, determine whether it belongs to the organisation and use it as a pivot where your telemetry allows.
Was a copy retained?
Configuration can affect whether mail remains in the original mailbox while also being forwarded. That distinction matters when assessing what the user may have noticed and what the external recipient may have received.
Stage 4 — correlate forwarding with suspicious access
One change becomes part of a sequence
The forwarding event is more significant when it appears in the same tightly clustered timeline as phishing, suspicious authentication and other unauthorised mailbox changes.
Ask whether the user expected it
User confirmation is useful business context, but combine it with technical evidence. “I didn't configure that” strengthens the case; it should not replace the audit trail.
Stage 5 — inspect nearby mailbox activity
let SuspiciousIP = "203.0.113.77";
CloudAppEvents
| where Timestamp > ago(1d)
| where AccountId =~ "alex@contoso.com"
| where IPAddress == SuspiciousIP
| project Timestamp,
ActionType,
Application,
IPAddress,
UserAgent,
RawEventData
| order by Timestamp asc
Forwarding may not be the only change
Review the surrounding session for inbox rules, permission changes or other mailbox operations. Multiple related changes can reveal the attacker's objective.
Do not stop after removal
Removing the forwarding configuration contains future exposure, but the investigation still needs to establish when it started and what may have been affected while it was active.
Stage 6 — establish the exposure window
Configuration time gives you a boundary
The first confirmed forwarding event and the remediation time help define the period that requires deeper message and data-exposure review.
Exposure is not the same as confirmed reading
If messages were forwarded externally, you can establish that they were sent to the destination. Do not claim that a person read or used them unless additional evidence supports that conclusion.
Stage 7 — understand why attackers value forwarding
| Attacker objective | Why forwarding helps |
|---|---|
| Monitor conversations | Future messages can continue arriving outside the compromised mailbox. |
| Business email compromise | Payment discussions and supplier correspondence may be observed. |
| Security awareness | Password-reset or account-security messages may reveal remediation activity. |
| Information collection | Incoming business data may continue to leave the organisation. |
This is why mailbox review matters
A password reset addresses a credential. It does not automatically remove every configuration change that may have been made while the attacker had access.
Contain the configuration
Follow organisational response procedures to remove unauthorised forwarding, secure the identity, review active sessions and inspect the mailbox for additional changes.
Stage 8 — build the complete evidence chain
Stage 9 — write the investigation finding
Lesson 48 key takeaways
- External forwarding can be configured through more than one mailbox or mail-flow mechanism.
- Identify the mechanism before deciding what the event means.
- Search mailbox audit telemetry for forwarding-related changes.
- Record the exact external destination and changed parameters.
- Correlate the change with suspicious sign-ins and other mailbox activity.
- Determine whether messages were forwarded while copies remained in the mailbox.
- Establish the forwarding start and remediation times to define the exposure window.
- Review messages and data that may have been affected during that window.
- Do not equate confirmed forwarding with proof that somebody read the forwarded messages.
- Identity containment should include review and remediation of unauthorised mailbox configuration.
Module 5 — Email & Phishing: From Message to Compromise
Lesson 48 followed a compromised mailbox into external forwarding and potential data exposure. Lesson 49 expands the investigation beyond the original user to determine whether the phishing campaign targeted anyone else.
Continue your SOC Analyst training
🔎 SOC Analyst Academy — Module 5: Email & Phishing: From Message to Compromise
Investigate external mailbox forwarding in Microsoft Defender XDR
Lesson 48 of the Agent Foskett SOC Analyst Academy teaches analysts how to identify suspicious external mailbox forwarding, inspect mailbox audit evidence and correlate forwarding changes with a compromised Microsoft 365 identity.
Hunt forwarding configuration changes with KQL
Use CloudAppEvents to investigate Set-Mailbox, New-InboxRule and Set-InboxRule activity, identify forwarding destinations, establish an exposure window and determine whether post-compromise mailbox changes may have exposed future messages.
