Technique

Email Forwarding Persistence

Also known as: Email Forwarding Rule, Malicious Email Rules

PERSISTENCEMITRE ATT&CK: Email Collection: Email Forwarding Rule (T1114.003) — technique definition covering adversary use of forwarding rules for persistent email access, with procedure examples from Kimsuky, LAPSUS$, Scattered Spider, Silent Librarian, and Star Blizzard

After gaining access to a victim's email account, attackers create hidden inbox rules that automatically forward incoming messages to an attacker-controlled external address. These rules often target emails containing keywords like 'payment', 'invoice', 'wire transfer', or 'confidential'. Attackers…

Common attack flows

How it fits in a scam

This technique shows up duringPERSISTENCE

Before

After

Defense

How to defend against this

How to spot it

  • Review email forwarding rules regularly — check for rules forwarding to unknown external addresses (use Get-InboxRule in Exchange/M365)
  • Look for inbox rules that automatically delete
  • move to obscure folders
  • or mark-as-read messages matching financial keywords
  • Monitor for unexpected gaps in expected email threads — missing replies
  • invoices
  • or payment confirmations you were expecting
  • Check if web-based email client has different rules than desktop client — rules set via webmail may not sync to Outlook
  • Watch for New-InboxRule
  • Set-InboxRule
  • or Set-Mailbox PowerShell cmdlet execution in audit logs
  • Unexpected email delivery failures or bounce-backs from unknown external addresses receiving forwarded copies
  • Business contacts reporting they received replies or instructions you never sent — indicates attacker is intercepting and responding via forwarded copies

Further reading