RARoot Access Labs

 /  Blog

Is someone quietly forwarding your company email?

When attackers get into a Microsoft 365 mailbox, one of the first things they often do is set up forwarding. Every email that arrives gets copied to an address they control. The owner notices nothing, and changing the password afterwards doesn't stop it, because the rule keeps running.

Invoices, bank details, client conversations and password reset emails all go straight out of the business.

The good news: it takes about five minutes to check every mailbox in your tenant.

The two ways mail gets forwarded

Mailbox forwarding is a setting on the mailbox itself. An admin can set it in the Microsoft 365 admin centre, or a user can set it in Outlook on the web under Settings → Mail → Forwarding.

Inbox rules are the rules users create in Outlook. A rule can forward or redirect messages, but attackers also use rules to hide things: moving security alerts or replies from the real client into a folder nobody opens, like RSS Feeds or Archive.

Check every mailbox in five minutes

You'll need the Exchange Online PowerShell module and an admin account. Install the module once:

Install-Module ExchangeOnlineManagement -Scope CurrentUser

Connect, then list every mailbox that forwards somewhere:

Connect-ExchangeOnline

Get-EXOMailbox -ResultSize Unlimited -Properties ForwardingSmtpAddress, ForwardingAddress |
    Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
    Select-Object UserPrincipalName, ForwardingSmtpAddress, ForwardingAddress

Then look for inbox rules that forward, redirect or delete mail:

Get-EXOMailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.UserPrincipalName -WarningAction SilentlyContinue |
        Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo -or $_.DeleteMessage } |
        Select-Object MailboxOwnerId, Name, Enabled, ForwardTo, RedirectTo, DeleteMessage
}

Both commands only read. Nothing changes in your tenant.

What to look for

You see What it might mean
Forwarding to a Gmail or Outlook.com address Could be innocent (someone forwarding to their phone), could be an attacker. Ask the owner.
A rule named ., .. or a single letter A classic attacker trick: short names are easy to miss. Treat it as hostile until proven otherwise.
A rule that deletes mail containing "invoice", "payment" or "password" Very likely someone hiding their tracks.
Forwarding to an address nobody recognises Treat the mailbox as compromised.

If something looks malicious, don't just delete the rule. Reset the user's password, sign them out of all sessions, check their sign-in logs, and look at what else changed. The rule is a symptom, not the whole problem.

Stop it happening again

Block automatic forwarding to outside addresses for the whole tenant. In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Anti-spam, open the outbound policy, and set Automatic forwarding rules to Off.

If one person genuinely needs to forward outside the business, create a separate outbound policy just for them. Everyone else stays blocked.

Check it worked

Run the first command again a week later. The list should be empty, or only contain forwarding you've approved. Put a reminder in your calendar to repeat the check every month: it's five minutes, and it catches one of the most damaging attacks there is early.

All posts