domains / families / security / detecting-email-forwarding-rules-attack

detecting-email-forwarding-rules-attack

separate

Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain

When to use

• When proactively hunting for indicators of detecting email forwarding rules attack in the environment
• After threat intelligence indicates active campaigns using these techniques
• During incident response to scope compromise related to these techniques
• When EDR or SIEM alerts trigger on related indicators
• During periodic security assessments and purple team exercises

Skill page

Source