Detection: O365 Suspicious Admin Email Forwarding

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detections updated to use the new search logic and field names due to the TA update

Removed in version: 5.2.0

Replacement: O365 Mailbox Email Forwarding Enabled

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: 7f398cfb-918d-41f4-8db8-2e2474e02c28 Author: Patrick Bareiss, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

DEPRECATION NOTE - This search has been deprecated and replaced with O365 Mailbox Email Forwarding Enabled. This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.

Search

1`o365_management_activity` Operation=Set-Mailbox 
2| spath input=Parameters 
3| rename Identity AS src_user 
4| search ForwardingAddress=* 
5| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress 
6| where count_src_user > 1 
7|`security_content_ctime(firstTime)` 
8|`security_content_ctime(lastTime)` 
9|`o365_suspicious_admin_email_forwarding_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
o365_management_activity	`sourcetype=o365:management:activity`
o365_suspicious_admin_email_forwarding_filter	``

o365_suspicious_admin_email_forwarding_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1114.003	Email Forwarding Rule	Collection

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Known False Positives

unknown

Associated Analytic Story

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 4