Exchange Online Inbox Rule Forwarding to External Domain (T1114.003)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•4•0•8

Detects the creation or modification of Exchange inbox rules that configure automatic forwarding or redirection of email to external domains. Attackers often use this technique to exfiltrate email data, maintain persistence, or monitor communications.