Today, we are going to discuss detecting hidden inbox forward rule in On-Premise Exchange. <\/p>\n\n\n\n
In many exchange email account compromise case investigations, attacker tends to add an inbox rule and forward victims’ emails to an email account under the attacker’s control. In order to make the victim(s) even harder to detect the forward rules, attackers use some more advanced techniques to hide the forward rules.<\/p>\n\n\n\n
There are different research articles discussing the hidden inbox forward rule on O365 including Compass Security<\/a>, Matthew Green<\/a>, and GCITS<\/a>. That’s why we will discuss it for On-Premise Exchange such as Exchange 2013, 2016 & 2019.<\/p>\n\n\n