EXT-07: Detect External Mail Forwarding

EXT-07 is a security control that attackers commonly set up mail forwarding rules after compromising accounts. these rules silently copy all emails to external addresses, enabling ongoing data theft even after the initial compromise is remediated. It requires that mailbox forwarding rules to external addresses are identified and inbox rules forwarding to external domains are flagged, no unexpected external forwarding rules exist.

Attackers commonly set up mail forwarding rules after compromising accounts. These rules silently copy all emails to external addresses, enabling ongoing data theft even after the initial compromise is remediated.

TrueConfig provides one-click remediation for EXT-07. TrueConfig can disable external auto-forwarding rules in one click (disable_mail_forwarding). The manual alternative is removing forwarding rules via Exchange admin access or the Microsoft Graph Reports API.

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

EXT-07 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.