name: O365 Suspicious Admin Email Forwarding
id: 7f398cfb-918d-41f4-8db8-2e2474e02c28
version: 1
date: '2020-12-16'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search detects when an admin configured a forwarding rule for multiple
  mailboxes to the same destination.
search: '`o365_management_activity` Operation=Set-Mailbox | spath input=Parameters
  | rename Identity AS src_user | search ForwardingAddress=* | stats dc(src_user)
  AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user)
  AS src_user values(user) AS user by ForwardingAddress | where count_src_user > 1
  |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_admin_email_forwarding_filter`'
how_to_implement: ''
known_false_positives: unknown
references: []
tags:
  analytic_story:
  - Office 365 Detections
  asset_type: Office 365
  automated_detection_testing: passed
  cis20:
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule/o365_email_forwarding_rule.json
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1114.003
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Operation
  - Parameters
  security_domain: threat
