AN1312: Analytic 1312
Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.
Analyst context for executives and security teams
AN1312 is a detection analytic for suspicious email auto-forwarding behavior in an Office Suite environment. Its business value is in identifying potential mailbox misuse where messages may be silently redirected outside normal workflows, especially when rule creation, auto-forwarded message headers, and abnormal logon source IPs line up. For leaders, this matters because mailbox forwarding can affect confidentiality, incident scope, legal hold expectations, and confidence in executive or finance communications.
Executive priority
Prioritize this as an email security and identity monitoring validation item. Security leaders should ask whether Exchange Web Services and Outlook rule changes, forwarded-message indicators, and logon anomaly context are collected and correlated in a way that supports timely investigation. The decision value is not just detecting a rule change, but proving whether the organization can connect mailbox configuration changes to suspicious access patterns for incident response and audit evidence.
Technical view
SOC and detection teams should validate correlation across three evidence points described by MITRE: unusual auto-forwarding rule creation through Exchange Web Services or the Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IP addresses. Because no official detection logic is supplied, teams should implement this as a correlation/use-case validation rather than assuming a ready-made analytic. Tuning should account for legitimate forwarding, delegated mailbox administration, helpdesk activity, mail migration activity, and approved business rules.
Likely telemetry
- Exchange Web Services activity related to mailbox or inbox rule creation
- Outlook rules engine or mailbox rule change events
- Message header data containing X-MS-Exchange-Organization-AutoForwarded
- Mailbox audit or email audit logs showing forwarding-related configuration changes
- User logon or session records with source IP address and location/context
Detection direction
- Confirm that rule creation events from both Exchange Web Services and Outlook rule mechanisms are visible; coverage for only one path may create a blind spot.
- Correlate forwarding-rule creation with auto-forwarded message headers rather than treating either signal alone as conclusive.
- Use abnormal IP or session context to prioritize alerts, while tuning for travel, VPN, proxy, and known administrative activity.
- Maintain allowlists or business context for approved forwarding workflows, but review them periodically because stale exceptions can hide risk.
- Validate that investigations can pivot from a suspicious rule to affected messages, mailbox owner, session history, and rule creator where logs permit.
Mitigation priorities
- Establish policy and governance for when mailbox auto-forwarding is allowed and how exceptions are approved.
- Ensure mailbox rule changes and sign-in/session activity are logged with sufficient retention for investigation.
- Review and restrict unnecessary external forwarding where business requirements allow.
- Strengthen identity controls for Office Suite access, especially for accounts with sensitive mailboxes or administrative capability.
- Create an incident response playbook for suspicious forwarding that includes rule removal, session review, credential assessment, and message exposure scoping.
Analyst notes and limits
This object is a detection analytic, not a technique or procedure description. The ATT&CK fields provide a concise analytic concept but no formal detection query, tactic mapping, or relationship context. Glexia’s interpretation is therefore focused on control validation: whether an organization can correlate mailbox rule changes, forwarded-message indicators, and anomalous logon context in Office Suite telemetry.
Official detection content is not provided, and no relationships are supplied. The object supports Office Suite and specifically references Exchange Web Services, Outlook rules, auto-forwarded headers, and abnormal IP logon sessions. Local mail architecture, logging configuration, retention, identity provider data, and approved forwarding practices are required to determine actual detection coverage and alert fidelity.
Analytic 1312
Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 8cde862741eb… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1312Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.