Detections
- ID: DT140
- Created: 12th August 2025
- Updated: 12th August 2025
- Contributor: The ITM Team
Microsoft Defender, Creation of Forwarding/Redirect Rule
The following detection is a default alert policy that should be enabled in all tenants automatically.
To view this alert policy, access the Microsoft Defender portal at https://security.microsoft.com, go to Email & collaboration > Policies & rules > Alert policy. Or, to go directly to the Alert policy page, use https://security.microsoft.com/alertpoliciesv2.
This rule will generate an alert when a forwarding/redirect rule is created within Exchange or OWA.
Sections
| ID | Name | Description |
|---|---|---|
| IF010 | Exfiltration via Email | A subject uses electronic mail to exfiltrate data. |
| PR015 | Email Collection | A subject may target user email to collect sensitive information. |
| IF010.001 | Exfiltration via Corporate Email | A subject exfiltrates information using their corporate-issued mailbox, either via software or webmail. They will access the conversation at a later date to retrieve information on a different system. |
| PR015.003 | Email Forwarding Rule | The subject creates an email forwarding rule to transport any incoming emails from one mailbox to another. |
| AF012.002 | Hide Emails With Rules | A subject may utilize email rules can be used to automatically move emails from an inbox to obscure locations, with the goal of hiding them from immediate view, delaying identification. |