T1114.003: Email Forwarding Rule
Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.[1] Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.[2] Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.[3][4]
Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.[2]
In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.[5] Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives.
Analyst context for executives and security teams
Email forwarding rules matter because they can turn a compromised mailbox into a quiet, long-running collection point. A user or administrator can create rules that forward messages internally or externally, and ATT&CK notes that some rules may persist even after a password reset or be hidden from common Exchange/Outlook administration views. For leaders, this is not just an email setting issue; it is a data exposure, incident confidentiality, and auditability problem.
Executive priority
Prioritize governance and evidence around who can create forwarding rules, where forwarded mail can go, and how rule changes are reviewed. This technique can expose sensitive business, legal, personal, or incident response communications and may undermine recovery assumptions if teams reset credentials but do not inspect mailbox and organization-wide mail-flow rules. It should be part of identity, email security, compliance readiness, and incident response playbooks.
Technical view
SOC and IR teams should validate visibility across user inbox rules, administrator-created forwarding, and organization-wide mail-flow or transport rules on the supported email environments and clients. Review rule creation and modification through local email applications, web interfaces, and command-line interfaces where available. Pay special attention to external forwarding, broad forwarding conditions, rules targeting specific senders, administrator-created rules, and hidden Microsoft Exchange rules modified through MAPI that may not appear in Outlook, OWA, or common Exchange administration tools. Treat this as a collection technique under Email Collection, and include mailbox rule review in credential compromise response.
Likely telemetry
- Mailbox inbox rule creation, modification, and deletion records
- Administrator audit logs for forwarding or mail-flow/transport rule changes
- Email platform configuration exports showing forwarding destinations and rule conditions
- Mail delivery or message trace logs showing automatic forwarding behavior
- Authentication and session records for accounts that created or changed rules
Detection direction
- Validate the related detection strategy DET0576 against local email platforms rather than assuming native coverage exists; ATT&CK provides no official detection text for this sub-technique.
- Baseline legitimate forwarding, delegation, compliance, ticketing, and administrative mail-flow use before alerting broadly.
- Prioritize alerts for external recipients, newly created forwarding rules, organization-wide transport rules, rules created soon after suspicious authentication, and rules that selectively forward mail from sensitive senders.
- Include checks for hidden inbox rules that may not be visible in Outlook, OWA, or common Exchange administration tooling.
- Tune for false positives from approved business workflows while requiring documented ownership, purpose, and review dates for persistent forwarding.
Mitigation priorities
- Audit regularly: maintain reviewable logs and periodic reporting for user inbox rules, administrator-created forwarding, and organization-wide mail-flow rules.
- Disable or restrict forwarding features that are not required, especially external or broad organization-wide forwarding, while preserving documented business exceptions.
- Use encryption for sensitive information so forwarded content is less useful if it leaves expected control boundaries.
- During incidents, use secure out-of-band communications for sensitive response coordination because compromised email may reveal investigation activity.
- After credential resets, inspect and remove unauthorized mailbox and transport rules; do not treat password reset alone as complete remediation.
Analyst notes and limits
ATT&CK maps this sub-technique to collection and to the parent Email Collection technique. The relationship set also shows use by Kimsuky, Silent Librarian, LAPSUS$, Scattered Spider, and Star Blizzard, which supports threat-informed prioritization but does not imply those groups are active in any specific environment. The strongest operational takeaway is to test whether mailbox rule visibility spans user, admin, client, web, command-line, transport-rule, and hidden-rule paths.
The official ATT&CK object does not provide detection text, and the related DET0576 strategy is named but not detailed in the supplied data. Local email platform logging, retention, administrative configuration, and approved business forwarding patterns are required to determine actual exposure and detection coverage.
Email Forwarding Rule
Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.[1] Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.[2] Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.[3][4]
Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.[2]
In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.[5] Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1114 | Email Collection | This object subtechnique of Email Collection. |
Groups, software, and campaigns
G1015: Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
G0122: Silent Librarian
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).[1][2][3]
G1004: LAPSUS$
LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.[1][2][3]
G1033: Star Blizzard
Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.[1][2][3][4]
G0094: Kimsuky
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]
Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]
DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.4 | Current bundle | 6274e6b39429… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
US-CERT TA18-068A 2018
US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.
Open source URL -
[2]
Pfammatter - Hidden Inbox Rules
Damian Pfammatter. (2018, September 17). Hidden Inbox Rules in Microsoft Exchange. Retrieved October 12, 2021.
Open source URL -
[3]
Microsoft Tim McMichael Exchange Mail Forwarding 2
McMichael, T.. (2015, June 8). Exchange and Office 365 Mail Forwarding. Retrieved October 8, 2019.
Open source URL -
[4]
Mac Forwarding Rules
Apple. (n.d.). Reply to, forward, or redirect emails in Mail on Mac. Retrieved June 22, 2021.
Open source URL -
[5]
Microsoft Mail Flow Rules 2023
Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023.
Open source URL -
[6]
mitre-attack T1114.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.