Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)

id: a5736802-3a1c-40aa-8e8f-7fbdaa52ae65
name: Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)
description: |
  This query lists the top external domains receiving automatically forwarded email, by forwarding type, using the EmailEvents table.
description-detailed: |
  Auto-forwarding to external domains is a common data-exfiltration technique after mailbox compromise. This query ranks the external recipient domains receiving auto-forwarded mail, split by forwarding type (mailbox rule versus SMTP forwarding), with the count of forwarded messages and the distinct internal forwarding users. Unfamiliar or personal-webmail domains receiving high volumes are worth investigating.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - Collection
  - Exfiltration
relevantTechniques:
  - T1114
  - T1020
query: |
  EmailEvents
  | where Timestamp > ago(30d)
  | where EmailDirection == "Outbound" and isnotempty(ForwardingInformation)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | extend FwdInfo = parse_json(ForwardingInformation)
  | extend ForwardingType = tostring(FwdInfo.ForwardingType),
           ForwardingUser = tostring(FwdInfo.ForwardingUser),
           RecipientDomain = tostring(split(RecipientEmailAddress, '@')[1])
  | summarize ForwardedMessages = count(),
              ForwardingUsers = dcount(ForwardingUser)
      by RecipientDomain, ForwardingType
  | top 20 by ForwardedMessages
version: 1.0.0