Skip to content

T1114.003 Email Forwarding Rule

Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.5 Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim’s emails even after compromised credentials are reset by administrators.2 Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.31

Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.2

In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.4 Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives.

Item Value
ID T1114.003
Sub-techniques T1114.001, T1114.002, T1114.003
Tactics TA0009
Platforms Google Workspace, Linux, Office 365, Windows, macOS
Version 1.3
Created 19 February 2020
Last Modified 12 April 2023

Procedure Examples

ID Name Description
G0094 Kimsuky Kimsuky has set auto-forward rules on victim’s e-mail accounts.10
G1004 LAPSUS$ LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.11
G0122 Silent Librarian Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.9


ID Mitigation Description
M1047 Audit Enterprise email solutions have monitoring mechanisms that may include the ability to audit auto-forwarding rules on a regular basis.
M1042 Disable or Remove Feature or Program Consider disabling external email forwarding.8
M1041 Encrypt Sensitive Information Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.


ID Data Source Data Component
DS0015 Application Log Application Log Content
DS0017 Command Command Execution