detections
- ID: DT140
- Created: 12th August 2025
- Updated: 12th August 2025
- Contributor: The ITM Team
Microsoft Defender, Creation of Forwarding/Redirect Rule
The following detection is a default alert policy that should be enabled in all tenants automatically.
To view this alert policy, access the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Policies & rules > Alert policy. Or, to go directly to the Alert policy page, use https://security.microsoft.com/alertpoliciesv2.
This rule will generate an alert when a forwarding/redirect rule is created within Exchange or OWA.
Sections
| ID | Name | Description |
|---|---|---|
| IF010 | Exfiltration via Email | A subject uses electronic mail to exfiltrate data. This can be achieved through including data in the email subject line or body, or utilizing email attachments to send files. |
| PR015 | Email Collection | A subject may target user email to collect sensitive information. |
| IF010.001 | Exfiltration via Corporate Email | A subject exfiltrates organizational information using a corporate-issued email account, either through an installed email application or webmail. The information may be transmitted to an external recipient or retained within the mailbox for subsequent unauthorized retrieval. |
| PR015.003 | Email Forwarding Rule | The subject creates an email forwarding rule to transport any incoming emails from one mailbox to another. |
| AF012.002 | Hide Emails With Rules | A subject may utilize email rules to automatically move emails from an inbox to obscure locations, with the goal of hiding them from immediate view and delaying identification. |