Detecting suspicious email forwarding rules on Office 365

Despite costing companies untold billions of dollars every year, email account compromise (EAC), business email compromise (BEC), and other email-based scams garner less attention—from defenders and media alike—than costly and often high-profile ransomware attacks. In today’s blog, we’re going to discuss the scope of email-based threats and offer guidance on what security teams can do about it.

Specifically, we’re going to talk about how Office 365 telemetry can help you detect email-based threats—and even more specifically about how we’re developing detection analytics that use Microsoft Unified Audit Logs to catch adversaries who attempt to forward email messages, a behavior associated with all variety of email-based threats and a wide variety of other attack techniques. Additionally, we’re going to explain how you can leverage this telemetry source in your own environment, and we’ll also include some tests you can run to validate your detection coverage.

The problem, quantified as best we can

According to the FBI Internet Crime Complaint Center (IC3), BEC alone cost victims more than $43B between June 2016 and December 2021—a figure that only increases when you combine it with other email-based threats. Cost estimates for ransomware, on the other hand, are all over the place, with the IC3 (almost certainly under-)reporting $30M in losses in 2020. Another oft-cited (but unsubstantiated) report estimates that ransomware might have cost as much as $20B in 2021.

Whatever the actual numbers are, the damages caused by email schemes are right on par with those caused by ransomware—and therefore, we should probably make sure we’re not treating these email-based threats as an afterthought.

An example, so we can show you how to detect bad things

We’re focusing on just one variant of email compromise in this article, namely those that involve an adversary who leverages email forwarding rules. Let’s talk through how things might play out before we describe some detection and testing options.

We’ll start at the point where an adversary has successfully logged into a victim’s mailbox. From there, an adversary can attempt to maintain access for as long as possible, quietly collecting valuable or sensitive information by simply reading through individual email messages, manually exporting messages to review offline, or stealthily forwarding email messages to external email accounts. In the latter scenario, adversaries may create email forwarding rules tied to a user’s account that auto-forward all or specific emails to an external SMTP address. Auto-forwarding emails in this way allows an adversary on-demand and real-time access to email messages without worrying about the legitimate user deleting emails or even changing their password. In other words, adversaries set up forwarding rules as a form of insurance in case they lose access to their victim’s email account.

Adversaries set up forwarding rules as a form of insurance in case they lose access to their victim’s email account.

In our example, we’ll say the adversary is only interested in emails that contain terms like “direct deposit,” “wire transfer,” or “password reset.” As such, they can set up a rule that automatically moves any emails containing those words in any part of the email to a mailbox folder the victim rarely checks, like their “RSS Feeds” or “Archived” folder. Part of the email rule might even mark the message as “read” or delete it altogether before forwarding the message to an external mailbox.

From here, if a message about fund transfer gets forwarded to the adversary, they might then respond to the sender (posing as the victim/recipient) with an email containing the direct deposit information of an account controlled by the adversary in an attempt to goad the victim into initiating a fraudulent wire transfer. Alternatively, they may just use the collected emails to launch additional phishing campaigns against the victim’s colleagues to further entrench themselves in the environment.

The Set-Mailbox Operation can also contain the following forwarding properties:

Now that we’ve specified some of the different ways that you can set up email forwarding and where you can collect relevant logs, let’s talk about how you can develop detection analytics using telemetry from the logs mentioned above.

Detection strategy #1

We find the following logic useful for detecting forwarding rules created via Outlook on the Web: