detecting-email-forwarding-rules-attack
by mukul975The detecting-email-forwarding-rules-attack skill helps Security Audit, threat hunting, and incident response teams find malicious mailbox forwarding rules used for persistence and email collection. It guides analysts through Microsoft 365 and Exchange evidence, suspicious rule patterns, and practical triage for forwarding, redirect, delete, and hide behaviors.
This skill scores 82/100, which means it is a solid directory candidate with enough real workflow value for users to consider installing. It has clear hunting intent, concrete detection artifacts, and supporting scripts/references that make it more actionable than a generic prompt, though some operational details are still incomplete.
- Clear use case and trigger: proactive hunting, incident response, EDR/SIEM alerts, and purple-team validation are explicitly listed in SKILL.md.
- Strong operational evidence: includes Microsoft Graph and Exchange Online examples, plus Splunk and KQL query snippets in references.
- Good agent leverage: repository includes working support scripts, workflow docs, and standards mappings that reduce guesswork for execution.
- No install command in SKILL.md, so users may need to wire the skill into their environment manually.
- The excerpts show solid detection content, but some workflow details are truncated or spread across files, which may slow first-time adoption.
Overview of detecting-email-forwarding-rules-attack skill
What this skill is for
The detecting-email-forwarding-rules-attack skill helps you hunt for malicious mailbox forwarding rules that attackers use to keep reading email after initial access. It is most useful for Security Audit, threat hunting, and incident response teams that need to confirm whether forwarding, redirect, delete, or hide rules were created without authorization.
Who should install it
Install the detecting-email-forwarding-rules-attack skill if you already collect Microsoft 365 or Exchange audit data, or if you need a repeatable workflow for ATT&CK T1114.003-style detections. It fits analysts who want a detection-oriented guide, not a generic “how to write a query” prompt.
What makes it different
This skill is practical rather than theoretical: it points to likely data sources, suspicious rule patterns, and repository files that can be reused in a hunt. The real job-to-be-done is narrowing a noisy mailbox-rule search into a defensible finding with evidence, scope, and a risk call.
How to Use detecting-email-forwarding-rules-attack skill
Install and inspect the right files
Use the detecting-email-forwarding-rules-attack install path in the repo or your skill manager, then read SKILL.md first. For useful implementation context, open references/workflows.md, references/api-reference.md, references/standards.md, and assets/template.md. Those files show the workflow, detection logic, query examples, and hunt output structure.
Feed the skill the inputs it actually needs
The detecting-email-forwarding-rules-attack usage works best when you provide: the email platform, time window, known account or tenant, log sources available, and what “suspicious” means in your environment. A weak request is: “find forwarding attacks.” A stronger one is: “hunt Exchange Online inbox rules from the last 14 days, prioritize external forwarding and delete-after-forward behavior, and return evidence fields for each hit.”
Shape your prompt for the hunt outcome
A good detecting-email-forwarding-rules-attack guide prompt should ask for one of three outputs: a hunt plan, a query set, or an investigation summary. Example: “Using Microsoft 365 audit logs and Graph inbox rules, produce a step-by-step hunt for T1114.003 with Splunk SPL and KQL examples, false-positive notes, and a triage checklist.” That framing helps the skill return actionable work instead of general advice.
Use the workflow in the right order
Start with the data source you trust most, usually Unified Audit Log, Microsoft Graph inbox rules, or SIEM-ingested Exchange events. Then check for rule actions like ForwardTo, RedirectTo, DeleteMessage, MarkAsRead, or folder moves to Junk/RSS. Correlate the rule creator, client IP, and timestamps before deciding whether the activity is malicious.
detecting-email-forwarding-rules-attack skill FAQ
Is this only for Microsoft 365?
Mostly, yes. The repository is centered on Exchange Online and Microsoft Graph-style inbox rules, so it is strongest in Microsoft 365 environments. You can adapt parts of it elsewhere, but the detecting-email-forwarding-rules-attack skill is not a general email-security framework.
Do I need this if I can write prompts myself?
If you already know the data model and detection patterns, a custom prompt may be enough. Install this skill when you want a repeatable detecting-email-forwarding-rules-attack install decision that gives you structure: what to query, what to look for, and how to triage likely abuse.
Is it beginner-friendly?
Yes, if you can work with audit logs or SIEM queries. It is less helpful if you have no mailbox telemetry, no Microsoft 365 access, or no way to validate whether forwarding rules are legitimate. In those cases, the skill may still help you plan, but not prove a detection.
When should I not use it?
Do not use it as a stand-in for full email compromise investigation. Forwarding rules are one persistence method, not the whole incident. If your case involves OAuth abuse, delegated access, or malicious transport rules, you need additional detections beyond this skill.
How to Improve detecting-email-forwarding-rules-attack skill
Give it better environment context
The highest-value input is your tenant reality: mail platform, audit log retention, named business exceptions, and whether forwarding to partner domains is normal. That context helps the detecting-email-forwarding-rules-attack skill reduce false positives and rank findings correctly.
Ask for evidence, not just hits
Common failure mode: getting a list of rules with no decision support. Ask for evidence columns such as user, mailbox, rule name, action, external destination, creation time, and why the rule is suspicious. For Security Audit work, this matters more than raw count.
Tighten the hunt with specific suspicious patterns
If the first output is too broad, narrow the request to one pattern at a time: external forwarding, delete-after-forward, financial keyword targeting, or hidden delivery behavior. Example: “Focus only on rules that forward externally and delete the original message, and separate true positives from normal delegation.”
Iterate from detection to validation
After the first pass, improve the next run with confirmed benign examples, a shorter date range, and any observed attacker behavior. That lets detecting-email-forwarding-rules-attack usage shift from generic hunting to precise validation, which is where the skill delivers the most value.