Zimbra Mail Redirected to External Address
Detects mail redirection on Zimbra Collaboration. Zimbra is widely deployed in government, education and smaller enterprises, has been the subject of repeated mass-exploitation campaigns, and is rarely covered by commercial detection content — the combination makes it a persistent soft target. Redirection is the standard persistence on a compromised mailbox: it survives password resets and quietly copies correspondence onward. Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED' | groupby sender, recipient, direction, remoteip, subject
Sigma
