MELTr
Home Vendors Search Download
Login
Vendors / Microsoft Corporation / Office 365 / Inbox Rule Created with External Forwarding
Microsoft Corporation logo

Event type

Inbox Rule Created with External Forwarding

New-InboxRule - User-level Email Forwarding

Records New-InboxRule operations where users create email forwarding rules, often with external forwarding to bypass administrator controls and exfiltrate sensitive data

JSON 23 fields Medium Generator

exchange inbox-rules email-forwarding user-activity data-exfiltration
Preview Sample View Schema
CLI Install
meltr templates install microsoft

Overview

What this event covers

Captures New-InboxRule operations where users create inbox rules to automatically forward emails to external addresses. This is a common technique for data exfiltration and persistence as it bypasses administrator-level mailbox forwarding controls and can be harder to detect.

When generated

  • ›User creates a new inbox rule via Outlook or OWA
  • ›Attacker with compromised credentials establishes forwarding persistence
  • ›Legitimate user sets up external email forwarding for convenience
  • ›Automated rule creation by compromised account

Security relevance

High

Compliance

GDPR (Data Protection & Transfer) HIPAA (PHI Exfiltration) PCI-DSS (Cardholder Data Protection) SOX (Financial Data Controls) NIST 800-53 (AC-2, AU-6, SI-4)

Frequency notes

Medium frequency in normal operations as users create legitimate rules. Suspicious indicators: rules with generic names ('Auto Archive'), external forwarding, keyword-based triggers targeting business content, StopProcessingRules=True, and especially creation during off-hours (4x multiplier for night, 3.5x for weekends).

Resources

Docs and tools

Office 365 Management Activity API Schema official New-InboxRule PowerShell Reference official Detect and Remediate Outlook Rules and Forms Attacks official MITRE ATT&CK - Email Forwarding Rule (T1114.003) reference Microsoft 365 Defender Native detection for suspicious inbox rule creation and modification Hawk PowerShell Module Hunt for malicious inbox rules and email forwarding configurations Get-InboxRule PowerShell Query and audit inbox rules across your organization

Generation

Configuration

Base frequency
8 events/hour
Time patterns
business_hours night_hours weekend
Business hours
2.0x
Night hours
4.0x
Weekend
3.5x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

CreationTime
DateTime Required

Timestamp when the inbox rule was created

Source: now() | iso8601

Format ISO 8601
Example 2024-12-15T09:17:33Z
Id
String Required

Unique identifier for this audit record

Source: random_guid()

Format GUID
Example f1e2d3c4-b5a6-7c8d-9e0f-1a2b3c4d5e6f
Operation
String Required

Exchange operation that was performed

Source: Static value 'New-InboxRule'

Example New-InboxRule
OrganizationId
String Required

Microsoft 365 tenant identifier

Source: Derived from organization domain

Format GUID
Example b4c5d6e7-8f9a-0b1c-2d3e-4f5a6b7c8d9e
RecordType
Integer Required

Office 365 audit log record type (1 = ExchangeAdmin)

Source: Static value 1

Example 1
ResultStatus
String Required

Outcome of the rule creation operation

Source: random_choice(['Success', 'Success', 'Success', 'Failed'])

Example Success
Values
  • Success Rule created successfully
  • Failed Rule creation failed (validation or permission error)
UserKey
String Required

Unique identifier for the user who created the rule

Source: registry.get_random_user().email

Example compromised.user@contoso.com
UserType
Integer Required

Type of user creating the rule

Source: random_choice([0, 2])

Example 0
Values
  • 0 Regular user
  • 2 Administrator
Workload
String Required

Office 365 service where the operation occurred

Source: Static value 'Exchange'

Example Exchange
UserId
String Required

User principal name of the account that created the rule

Source: registry.get_random_user().email

Format Email/UPN
Example compromised.user@contoso.com
ClientIP
String Required

IP address and port from which the rule was created

Source: random_choice([random_public_ip(), random_public_ip(), random_private_ip()]) - weighted toward external IPs

Format IPv4:Port
Example 198.51.100.88:43921
ObjectId
String Required

Mailbox for which the rule was created

Source: registry.get_random_user().email

Format Email/UPN
Example compromised.user@contoso.com
ExternalAccess
Boolean Required

Indicates if the rule was created from outside the corporate network

Source: random_choice(['true', 'true', 'false']) - weighted 67% external

Example true
OrganizationName
String Required

Microsoft 365 tenant name

Source: Derived from organization domain

Format *.onmicrosoft.com
Example contoso.onmicrosoft.com
OriginatingServer
String Required

Exchange server that processed the rule creation

Source: Random Exchange Online server identifier

Example BN8PR01MB5678 (15.20.7654.32)
Parameters
Array Required

Parameters used when creating the inbox rule

Source: Array of parameter objects defining rule behavior

Parameters[].Name
String Required

Parameter name (Name, SubjectContainsWords, ForwardTo, StopProcessingRules, DeleteMessage, Mailbox)

Example SubjectContainsWords
Parameters[].Value
String Required

Parameter value - critical fields include ForwardTo (external email), SubjectContainsWords (keywords for targeting), StopProcessingRules (prevents detection)

Source: Context-specific values - keywords target business content, ForwardTo contains external addresses

Example invoice,payment,urgent,confidential
SessionId
String Required

Session identifier for the user connection

Source: random_guid()

Format GUID
Example a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
ClientInfoString
String Optional

Information about the client used to create the rule (OWA, Outlook, etc.)

Source: Random client type and access method

Example Client=OWA;Action=ViaProxy;
Item
Object Required

Details about the created inbox rule

Source: Object with rule name and parent folder path

Item.Id
String Required

Name of the inbox rule (often benign-sounding to avoid detection)

Source: Random benign-sounding rule name

Example Auto Archive Important Messages
Item.ParentFolder.Path
String Required

Location where the rule is stored

Source: Static value '/Inbox Rules'

Example /Inbox Rules