Email Forwarding Rule

Why do adversaries leverage email forwarding rules?

Business email compromise (BEC) and email account compromise (EAC) attacks remained prevalent in 2023. Adversaries use compromised credentials or identities to access email accounts, leveraging their legitimacy to bypass automated security controls and to trick otherwise phish-aware users who apply more scrutiny to external or unfamiliar email addresses. Adversaries also use email forwarding rules to hide their activity from the legitimate user or to exfiltrate data to an external email address. Forwarding emails to an external account may also allow an adversary to continue receiving sensitive information after losing access to the account.

Email messages coming from legitimate or internal email addresses aren’t subject to the same level of automated security controls that may block or inspect external emails.

An important distinction should be made here: The email compromises and forwarding rules that Red Canary observed in 2023 involved an adversary gaining access to a legitimate email account in an organization and using it to conduct malicious activity. This differs from traditional social engineering where an adversary uses a fake or spoofed email address pretending to be part of the organization. Email messages coming from legitimate or internal email addresses aren’t subject to the same level of automated security controls that may block or inspect external emails. They also do a far better job of passing a security-savvy user’s “sniff test” that might otherwise recognize a phishing attempt from a suspicious or unrecognized email domain. This applies to both internal communications as well as those with trusted external parties such as vendors, customers, or other business partners.

As such, adversaries have ample incentive to compromise email accounts rather than simply impersonate them. Beyond the immediate benefits of using the compromised email account for fraud, gaining access to these accounts with legitimate credentials also allows adversaries to search the inbox for useful information or sensitive documents.

How do adversaries leverage email forwarding rules?

After gaining access to the email account (typically through a compromised identity or credentials), the adversary can create forwarding rules in the same way a legitimate user does. In 2023, Red Canary observed adversaries creating mailbox rules with simple names, usually just a single or double period (., ..), a semicolon (;) or a single letter. We also saw repetitive rule names such as aaaa or ......... We observed this technique in a back-to-school campaign in fall 2023, and we also covered it in the Email threats section of the 2023 Threat Detection Report and in other blogs.

These rules typically take messages containing certain keywords (such as “invoice” or ”payroll”), or all messages from a certain sender (such as the HR department or any other individuals with whom the adversary is trying to communicate) and forward them to a folder that the legitimate user rarely checks–the RSS Subscriptions and Archived folders were the top culprits in 2023–while marking the emails as read. Red Canary also observed rules that forwarded messages to an external account under the adversary’s control, as well as rules that ignored any subtlety and simply deleted all incoming emails.

One emergent technique that may be adjacent to this technique but warrants mention involves adversaries using local mail client features such as marking emails as junk, blocking senders, or otherwise redirecting emails to the Junk folder. While this doesn’t necessarily involve the creation of an actual email forwarding rule, it serves the same practical purpose as malicious email forwarding rules and we are observing it with increasing frequency. There are three benefits to this novel approach:

1. Redirecting emails to the Junk folder blends in with the thousands of expected “blocked sender” actions that happen daily.
2. It’s easier and faster than creating an actual email forwarding rule.
3. It will evade detection in mail server logs or network observations.

Many of these forwarding rules are created using a login originating from a suspicious IP address. Most often, these IPs are inconsistent with the user’s typical IP block or login location. We observed many logins via commonly available virtual private networks (VPN) and other anonymizing tools.

The scheme typically unfolds as follows:

1. Adversary logs into a mailbox with compromised credentials, stolen session tokens, or some other method of compromising an identity. The originating IP address is almost always from an anonymizing proxy organization including Private Internet Access, ExpressVPN, or other VPN.
2. The adversary performs reconnaissance of mail items by viewing attachments with terms such as “invoice,” “ach,” “wire transfer,” or “payroll,” then creates a forwarding rule for the newly discovered sensitive mail items (or blocks the sender so future messages are automatically delivered to the Junk folder).
3. The adversary initiates or inserts themself into a conversation with internal colleagues in finance-related positions like payroll or procurement departments, or more commonly, with external trusted vendors involved in business transactions.
4. The adversary tricks email recipients into modifying ACH payroll or wire transfer destinations, rerouting money from its proper destination to an account controlled by the adversary.
5. Sent messages are immediately moved to a different folder or deleted.
6. Mail responses are automatically redirected to the users’ Junk folder (or another folder specified by an email rule), leaving the actual user unaware of the conversations initiated on their behalf.

Office 365 users can disable external email forwarding rules for their organization by following this guide by Microsoft. The steps outlined in this detailed Office 365 hardening guide provided by Mandiant will also help shrink your attack surface.

Note: The visibility sections in this report are mapped to MITRE ATT&CK data sources and components.

Application logs

For most organizations, MITRE Data Source DS0015: Application Log will provide the visibility necessary to detect suspicious email forwarding rules. The details of what activity is visible may differ between platforms such as Google Workspace or Microsoft Office 365 (On and off premise), but login activity and email rule creation are both actions that should be logged by whichever email application your organization uses.

For Office 365, this would include the Unified Audit Log (UAL). If you’re running an on-premise Exchange server, it’s a little less straightforward, but you can likely collect relevant logs from a combination of Mailbox Audit Logging and Exchange Admin center, and you can hunt for email rules using PowerShell cmdlets and by monitoring other log sources.

For Google Workspace users, the Security Investigation Tool will be your starting point and suspicious email rules can be observed by obtaining user Gmail settings through the Gmail API.

Note: The collection sections of this report showcase specific log sources from native event logs, third-party tools, and elsewhere that you can use to collect relevant security information.

For Office 365 users, the UAL is key to identifying not only suspicious email forwarding rules but all steps and aspects of BEC and EAC. There are many tools available to extract components of the UAL or even the entire log. Whichever platform you choose, be sure to collect the UAL operations and properties outlined in the Detection section below.