EXT-07: Detect External Mail Forwarding

EXT-07 is a security control that attackers commonly set up mail forwarding rules after compromising accounts. these rules silently copy all emails to external addresses, enabling ongoing data theft even after the initial compromise is remediated. It requires that mailbox forwarding rules to external addresses are identified and inbox rules forwarding to external domains are flagged, no unexpected external forwarding rules exist.

Attackers commonly set up mail forwarding rules after compromising accounts. These rules silently copy all emails to external addresses, enabling ongoing data theft even after the initial compromise is remediated.

EXT-07 requires manual implementation. Requires Exchange admin access or Microsoft Graph Reports API

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

EXT-07 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.

EXT-07 is rated critical because failure to implement this control significantly increases the risk of security incidents. Attackers commonly set up mail forwarding rules after compromising accounts. These rules silently copy all emails to external addresses, enabling ongoing data theft even after the initial compromise is remediated.