---
title: Microsoft 365 Exchange inbox rule set up to automatically forward email
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Microsoft 365 Exchange inbox rule set
  up to automatically forward email
---

# Microsoft 365 Exchange inbox rule set up to automatically forward email
Classification:attackTactic:[TA0009-collection](https://attack.mitre.org/tactics/TA0009)Technique:[T1114-email-collection](https://attack.mitre.org/techniques/T1114) 
## Goal{% #goal %}

Detect when a user configures an inbox forwarding rule.

## Strategy{% #strategy %}

Monitor Microsoft 365 Exchange audit logs to look for the operation [`New-InboxRule`](https://learn.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps) or [`Set-InboxRule`](https://learn.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps). Inbox rules automatically perform specific actions on emails that arrive in an inbox. Forwarding rules allow users to send email messages to another inbox inside or outside of the organization. Attackers can use inbox rules to collect and exfiltrate email data to an external account.

## Triage and response{% #triage-and-response %}

1. Inspect the inbox rule for any indicators:
   - Email addresses that are external to your organization.
1. Determine if there is a legitimate use case for the inbox rule by contacting the user `{{@usr.email}}`.
1. If the user `{{@usr.email}}` is not aware of the inbox rule:
   - Investigate other activities performed by the user `{{@usr.email}}` using the Cloud SIEM - User Investigation dashboard.
   - Begin your organization's incident response process and investigate.

## Changelog{% #changelog %}

- 17 August 2023 - Updated query to replace attribute `@threat_intel.results.subcategory:tor` with `@threat_intel.results.category:tor`.
- 18 December 2025 - Removed corporate VPNs as a threat intel source.