Test Detection for Microsoft 365 – Inbox Forwarding Rule
Microsoft 365 Inbox Forwarding Rule
The creation of an Microsoft 365 inbox rule is often a technique used to exfiltrate email that is often used for recon purposes in a staged attack. By monitoring for new inbox rule creation, you can have immediate awareness of what could be a malicious activity.How to Test Office365 Inbox Forwarding Rule
Prerequisites:- Office 365 module is configured and properly logging to Blumira
- Sign in to office365 email account in Outlook
- Navigate to Settings > View all Outlook settings
- Mail > Forwarding > Enable forwarding > add forwarding email address > Click Save
- Within minutes, a finding (alert) appears within the Blumira responder dashboard
Additional Security Resources
View All Posts
Customer Success Stories
7 min read
| January 6, 2025
Customer Story: District of Sparwood
Read More
Blog
5 min read
| January 3, 2025
Microsoft Defender for Cloud Apps: Integrate with Blumira SIEM
Read More
Customer Success Stories
7 min read
| October 10, 2024