MELTr
Home Vendors Search Download
Login
Vendors / Microsoft Corporation / Office 365 / Mailbox External Forwarding Configuration
Microsoft Corporation logo

Event type

Mailbox External Forwarding Configuration

Set-Mailbox with ForwardingSmtpAddress - Data Exfiltration Risk

Records Set-Mailbox operations that configure external email forwarding, a common data exfiltration technique where emails are automatically forwarded to external addresses

JSON 22 fields Low Generator

exchange email-forwarding data-exfiltration mailbox-configuration security-risk
Preview Sample View Schema
CLI Install
meltr templates install microsoft

Overview

What this event covers

Captures Set-Mailbox operations that configure ForwardingSmtpAddress, enabling automatic forwarding of emails to external addresses. This is a critical security event as it's commonly used for data exfiltration and persistence.

When generated

  • ›Administrator configures email forwarding for a user mailbox
  • ›Attacker with compromised admin credentials sets up data exfiltration
  • ›Mailbox delegation includes external forwarding
  • ›Legitimate business process requires external email forwarding

Security relevance

Critical

Compliance

GDPR (Data Protection) HIPAA (PHI Exfiltration Risk) PCI-DSS (Cardholder Data Protection) SOX (Financial Data Controls) NIST 800-53 (AC-2, AU-6)

Frequency notes

Low frequency under normal operations. Sudden increases or external forwarding to free email services (Gmail, Outlook.com) are high-priority security alerts. Night/weekend activity is particularly suspicious (3x multiplier).

Resources

Docs and tools

Office 365 Management Activity API Schema official Set-Mailbox PowerShell Reference official Detecting Email Forwarding Rules official MITRE ATT&CK - Email Forwarding Rule (T1114.003) reference Microsoft 365 Defender Native detection and response for O365 threats including email forwarding Azure Sentinel O365 Connector Ingest and analyze Office 365 audit logs in Azure Sentinel Hawk PowerShell Module PowerShell-based tool for gathering information related to O365 intrusions and compromises

Generation

Configuration

Base frequency
2 events/hour
Time patterns
business_hours night_hours weekend
Business hours
1.5x
Night hours
3.0x
Weekend
2.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

CreationTime
DateTime Required

Timestamp when the Set-Mailbox operation was executed

Source: now() | iso8601

Format ISO 8601
Example 2024-12-15T14:23:47Z
Id
String Required

Unique identifier for this audit record

Source: random_guid()

Format GUID
Example a8f3c2d1-4b5e-6a7f-8c9d-0e1f2a3b4c5d
Operation
String Required

Exchange PowerShell cmdlet executed

Source: Static value 'Set-Mailbox'

Example Set-Mailbox
OrganizationId
String Required

Microsoft 365 tenant identifier

Source: Derived from organization domain with random hex

Format GUID
Example b4c5d6e7-8f9a-0b1c-2d3e-4f5a6b7c8d9e
RecordType
Integer Required

Office 365 audit log record type (1 = ExchangeAdmin)

Source: Static value 1

Example 1
Values
  • 1 ExchangeAdmin - Exchange administrative operations
ResultStatus
String Required

Outcome of the operation

Source: random_choice(['Success', 'PartiallySucceeded', 'Failed'])

Example Success
Values
  • Success Operation completed successfully
  • PartiallySucceeded Operation completed with warnings
  • Failed Operation failed
UserKey
String Required

Unique identifier for the user who performed the action

Source: registry.get_random_user().email

Example admin@contoso.com
UserType
Integer Required

Type of user performing the action

Source: random_choice([0, 2])

Example 0
Values
  • 0 Regular user
  • 2 Administrator
Workload
String Required

Office 365 service where the operation occurred

Source: Static value 'Exchange'

Example Exchange
UserId
String Required

User principal name of the account that performed the action

Source: registry.get_random_user().email

Format Email/UPN
Example admin@contoso.com
ClientIP
String Required

IP address and port of the client that performed the operation

Source: random_choice([random_public_ip(), random_private_ip()]) with random_port()

Format IPv4:Port
Example 203.0.113.45:52874
ObjectId
String Required

Target mailbox that was modified

Source: registry.get_random_user().email

Format Email/UPN
Example finance.user@contoso.com
ExternalAccess
Boolean Required

Indicates if the operation was performed from outside the corporate network

Source: random_choice(['true', 'false', 'false', 'false']) - weighted 25% external

Example true
OrganizationName
String Required

Microsoft 365 tenant name

Source: Derived from organization domain

Format *.onmicrosoft.com
Example contoso.onmicrosoft.com
OriginatingServer
String Required

Exchange server that processed the operation

Source: Random Exchange Online server identifier with version

Example BN8PR01MB5678 (15.20.7654.32)
Parameters
Array Required

PowerShell parameters used in the Set-Mailbox operation

Source: Array of parameter objects

Parameters[].Name
String Required

Parameter name (Identity, ForwardingSmtpAddress, DeliverToMailboxAndForward)

Example ForwardingSmtpAddress
Parameters[].Value
String Required

Parameter value - ForwardingSmtpAddress contains external email in smtp: format

Source: Random external email address with smtp: prefix

Example smtp:external.recipient@gmail.com
SessionId
String Required

Session identifier for the administrative connection

Source: random_guid()

Format GUID
Example c9d8e7f6-5a4b-3c2d-1e0f-9a8b7c6d5e4f
ClientInfoString
String Optional

Information about the client application used

Source: Random client type (WebServices, OWA, PowerShell)

Example Client=WebServices;Mozilla/5.0;
Item
Object Required

Object containing details about the modified mailbox

Source: Object with Id and ParentFolder

ModifiedProperties
Array Required

Properties that were changed, showing old and new values

Source: Array showing ForwardingSmtpAddress and DeliverToMailboxAndForward changes