1. Home
  2. ATT&CK Techniques
  3. T1114.003 Email Forwarding Rule

T1114.003 Email Forwarding Rule

Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)

Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules)

In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-03.03 Email verification mechanisms Mitigates T1114.003 Email Forwarding Rule
Comments
This diagnostic statement provides protection from adversaries that try to gain sensitive information and data from users via email. Utilizing methods such as encryption is recommended to minimize the risk of adversaries collecting user's credentials via email forwarding rules to collect credentials and other sensitive information.
References
    PR.PS-01.07 Cryptographic keys and certificates Mitigates T1114.003 Email Forwarding Rule
    Comments
    This diagnostic statement protects against Email Forwarding Rule through the use of key management. Employing key protection strategies for key material used in protection of emails, limitations to specific accounts along with access control mechanisms provides protection against adversaries abusing email forwarding rule.
    References
      ID.AM-08.03 Data governance and lifecycle management Mitigates T1114.003 Email Forwarding Rule
      Comments
      This diagnostic statement protects credential data and sensitive PII from being stolen from adversaries found in emails. It also prevents adversaries from abusing email forwarding rules. There may be some similarities to NIST 800-53 SI-12 Information Management and Retention. This may provide mitigation of data access/exfiltration techniques.
      References
        ID.AM-08.05 Data destruction procedures Mitigates T1114.003 Email Forwarding Rule
        Comments
        This diagnostic statement protects credential data and sensitive PII from being stolen from adversaries found in emails. It also prevents adversaries from abusing email forwarding rules. There may be some similarities to NIST 800-53 SI-12 Information Management and Retention. This may provide mitigation of data access/exfiltration techniques.
        References

          NIST 800-53 Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          CM-06 Configuration Settings mitigates T1114.003 Email Forwarding Rule
          AC-17 Remote Access mitigates T1114.003 Email Forwarding Rule
          SC-37 Out-of-band Channels mitigates T1114.003 Email Forwarding Rule
          AC-19 Access Control for Mobile Devices mitigates T1114.003 Email Forwarding Rule
          SI-12 Information Management and Retention mitigates T1114.003 Email Forwarding Rule
          SC-43 Usage Restrictions mitigates T1114.003 Email Forwarding Rule
          SI-07 Software, Firmware, and Information Integrity mitigates T1114.003 Email Forwarding Rule
          AC-16 Security and Privacy Attributes mitigates T1114.003 Email Forwarding Rule
          AC-20 Use of External Systems mitigates T1114.003 Email Forwarding Rule
          SI-04 System Monitoring mitigates T1114.003 Email Forwarding Rule
          AC-04 Information Flow Enforcement mitigates T1114.003 Email Forwarding Rule
          SC-07 Boundary Protection mitigates T1114.003 Email Forwarding Rule

          VERIS Mappings

          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
          attribute.confidentiality.data_disclosure None related-to T1114.003 Email Forwarding Rule
          attribute.integrity.variety.Alter behavior Influence or alter human behavior related-to T1114.003 Email Forwarding Rule