Exchange Mail Redirected to External Domain
Detects mail being redirected to an external recipient. Redirection rules are the classic persistence mechanism on a compromised mailbox: they survive password resets, require no further access, and quietly copy correspondence to the attacker for as long as they remain in place. This is among the most under-monitored controls in most estates, because the rule is set once and never fires an alert again. Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='MS-EXCHANGE' and action='EMAIL_REDIRECTED' | groupby sender, recipient, direction, remoteip
Sigma
