T1114.003Email Forwarding Rule
T1114.003 — Email Forwarding Rule is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 14 detection use cases covering it and 4 threat-intel articles citing it.
Collection
14Use cases
4Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1114 · Email Collection
Use cases covering this technique (14)
Google Workspace email auto-forwarding to external domain M365 mail-forwarding rule created O365 Email New Inbox Rule Created O365 Email Suspicious Behavior Alert O365 Email Transport Rule Changed O365 Mailbox Email Forwarding Enabled O365 New Email Forwarding Rule Created O365 New Email Forwarding Rule Enabled O365 Suspicious Admin Email Forwarding O365 Suspicious User Email Forwarding [LLM] Post-compromise malicious inbox rule for defense evasion (UAT-11764 / ARToken BEC) [LLM] ARToken BEC toolkit: inbox forwarding/hiding rule creation on compromised M365 mailbox [LLM] Post-device-code malicious inbox rule creation (BEC prep) [LLM] Outbound email BCC'd to giftshop.club exfil domain (postmark-mcp backdoor)Articles citing this technique (4)
high Catan and Mouse art-261