detecting-email-forwarding-rules-attack

Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.

インストールへ移動

リポジトリ: xalgord/xalgorix
ソースの最終更新活動: 2026年6月6日 16:41
検出された SKILL.md の言語: 英語
スター: 813
フォーク: 146

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/xalgord/xalgorix --skill detecting-email-forwarding-rules-attack

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

このリポジトリのすべてを見る

Detecting Email Forwarding Rules Attack

When to Use

When proactively hunting for indicators of detecting email forwarding rules attack in the environment

After threat intelligence indicates active campaigns using these techniques

During incident response to scope compromise related to these techniques

When EDR or SIEM alerts trigger on related indicators

During periodic security assessments and purple team exercises

Detection Gaps & Validation

Forwarding hides in three places. Querying only inbox rules (New-InboxRule) misses mailbox-level forwarding (Set-Mailbox -ForwardingSmtpAddress / -ForwardingAddress) and Exchange transport rules. Hunt all three operations or you cover only a third of the attack surface.

Log source must be on. M365 detection depends on the Unified Audit Log and mailbox auditing. Verify with Get-AdminAuditLogConfig / Get-Mailbox | fl AuditEnabled; if UAL is off, New-InboxRule/Set-Mailbox/UpdateInboxRules events never land.

Evasion patterns: unnamed rules, rules that forward then mark-as-read and move mail to RSS/Deleted Items/Archive (hiding it from the user), client-only OWA rules, and forwarding to a look-alike internal domain.

No interactive logon: Graph API and malicious OAuth app consent can create rules without a sign-in event — correlate rule creation with AzureAD audit logs and risky/new app consents.

Validate the rule fires: create a benign inbox rule forwarding to an internal test mailbox and confirm a New-InboxRule (or Set-Mailbox) entry appears in the Unified Audit Log (allow ~30-60 min for ingestion).

Tune false positives: delegates, helpdesk/shared mailboxes, and vacation auto-forwards are legitimate. Allowlist those and alert specifically on forwarding to external or newly-seen recipient domains.

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)

SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)

Sysmon deployed with comprehensive configuration

Windows Security Event Log forwarding enabled

Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.