Email Forwarding Rule
Subtechnique · ATTACK:enterprise:T1114.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1114.003",
"title": "Email Forwarding Rule",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1114/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--7d77a07d-02fe-4e88-8bd9-e9c008c01bf0",
"external_id": "T1114.003",
"domain": "enterprise",
"created": "2020-02-19T18:54:47.103Z",
"modified": "2025-10-24T17:49:00.920Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Mac Forwarding Rules",
"url": "https://support.apple.com/guide/mail/reply-to-forward-or-redirect-emails-mlhlp1010/mac"
},
{
"source_name": "Pfammatter - Hidden Inbox Rules",
"url": "https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/"
},
{
"source_name": "Microsoft Tim McMichael Exchange Mail Forwarding 2",
"url": "https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/"
},
{
"source_name": "Microsoft Mail Flow Rules 2023",
"url": "https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules"
},
{
"source_name": "US-CERT TA18-068A 2018",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-086A"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1251a031-96c4-4188-8bb3-15e02979d61e
CrowdStrike Scattered Spider JUL 2025ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38b2c8da-e69e-4e17-8ba9-c967d7af3a0a
Microsoft BEC CampaignATTACK:enterprise:T1114.003 → subtechnique-of → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--636ec213-31ce-4e0a-863c-8add1cae68c3
ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67f029d5-c44b-446b-9efe-0e0e0d85192a
DOJ Iran Indictments March 2018ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7647807e-71b6-41e4-b0aa-f23e68b411cd
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e134214-4cb2-438b-9306-22e7d1ea80fe
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd1a91ea-4b59-4352-b902-941fbec64f29
Pfammatter - Hidden Inbox Rules · Microsoft Tim McMichael Exchange Mail Forwarding 2 · Microsoft Manage Mail Flow Rules 2023 · Microsoft Get-InboxRuleATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d53397d8-02c7-4d31-a512-8b0226e38d6e
CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8523d2e-2552-4d14-8980-dde0923c803d
CISA AA20-301A KimsukyATTACK:enterprise:M1060 → mitigates → ATTACK:enterprise:T1114.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8c2ee5b-293a-443d-be23-76a8cb8a8f3f
TrustedSec OOB Communications