Detecting Email Forwarding Rules Attack
FreeHunt for malicious email forwarding rules effectively.
Free · Opens the source repo
What Detecting Email Forwarding Rules Attack does
The Detecting Email Forwarding Rules Attack skill is designed for cybersecurity professionals focused on identifying and mitigating threats associated with email forwarding rules used by adversaries. These rules can be exploited to maintain persistent access to email communications, often as part of business email compromise (BEC) strategies. This skill is particularly useful for proactive threat hunting, incident response, and security assessments, providing a structured workflow to detect and analyze suspicious email forwarding behaviors.
This skill guides users through a systematic approach starting from hypothesis formulation based on threat intelligence, through to the identification of relevant data sources, execution of detection queries, and analysis of results. By leveraging existing EDR and SIEM platforms, users can gather telemetry and logs necessary to validate their hypotheses. The skill emphasizes the importance of correlating findings with broader attack patterns and threat actor tactics, techniques, and procedures (TTPs), ensuring a comprehensive understanding of the threat landscape.
The skill is particularly relevant in scenarios where threat intelligence indicates active campaigns utilizing email forwarding techniques, or when alerts from EDR or SIEM systems suggest potential compromise. It supports security teams in documenting their findings, updating detection rules, and recommending appropriate response actions to mitigate risks associated with email forwarding rule attacks.
By employing this skill, security practitioners can enhance their capabilities in detecting and responding to sophisticated email threats, ultimately strengthening their organization's security posture against persistent adversaries.
When to use it
Use this skill when hunting for indicators of email forwarding rule attacks, during incident response, or when alerts are triggered by EDR or SIEM systems.
When not to use it
This skill may not be suitable for environments without EDR or SIEM capabilities, or where email forwarding rules are not a relevant threat vector.
What you can build with it
Hunting for Suspicious Rules
A security analyst uses the skill to proactively hunt for unusual email forwarding rules in their organization’s email system.
Incident Response to BEC
During an incident response, a team utilizes the skill to investigate a compromised account suspected of forwarding sensitive emails.
Security Assessment
A cybersecurity team employs the skill during a security assessment to evaluate the presence of malicious email rules as part of their overall threat landscape.
How to install Detecting Email Forwarding Rules Attack
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-email-forwarding-rules-attack --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Email Forwarding Rules Attack
When to Use
- When proactively hunting for indicators of detecting email forwarding rules attack in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1114.003 | Email Forwarding Rule |
| T1114.002 | Remote Email Collection |
| T1098.002 | Additional Email Delegate Permissions |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: BEC actor creating forwarding rule to external email
- Scenario 2: Compromised account with rule deleting security alerts
- Scenario 3: Inbox rule forwarding CEO emails to attacker mailbox
- Scenario 4: OAuth app abuse creating transport rules for data collection
Output Format
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1114.003
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Detecting Email Forwarding Rules Attack
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.