Risky user behaviors involving email rules can create significant vulnerabilities in organizational security. As IT professionals, understanding these threats is essential for safeguarding email systems, particularly within environments like Microsoft Exchange or Microsoft 365. Below are key threats related to risky user behaviors with email rules:

1. Exfiltration of Sensitive Data

Users can create email rules that automatically forward emails to external accounts or unauthorized internal recipients. This presents a risk for data exfiltration, where sensitive information could be sent outside the organization, bypassing security measures like Data Loss Prevention (DLP).

• Automatic Forwarding to Personal Accounts: Users might set up rules that automatically forward emails to personal accounts for convenience. This puts sensitive data outside the organization’s controlled environment, making it harder to monitor and secure.
• Exfiltration through Covert Forwarding: Attackers who compromise a user’s account might configure hidden forwarding rules to send copies of all emails to an external address, capturing confidential information in real time.

2. Evasion of Security Monitoring

Malicious actors can use email rules to hide or alter incoming phishing attempts or other suspicious emails, making them harder to detect and respond to.

• Folder Redirection: Users or attackers may create rules to automatically move incoming emails from certain senders or with certain keywords directly to folders other than the inbox (like Junk or Archive). This can delay detection and response to potential phishing emails or alerts from security tools.
• Rule Obfuscation: Attackers may use obscure rule names or rules that contain conditional logic to evade detection by both users and automated monitoring systems. By hiding phishing attempts, attackers increase the likelihood of successful credential theft or malware deployment.

3. Privilege Escalation and Impersonation

Compromised user accounts with specific email rules can be leveraged by attackers to perform privilege escalation or impersonation attacks.

• Unauthorized Email Redirection: Attackers might use email rules to divert emails intended for executives or managers to themselves or other compromised accounts. This facilitates Business Email Compromise (BEC) by enabling attackers to intercept, modify, or delay critical communications.
• Impersonation of Internal Contacts: By redirecting certain types of emails, attackers can impersonate legitimate users within the organization. This allows them to request sensitive information, authorize fraudulent transactions, or deploy further phishing attempts without raising suspicion.

4. Persistence in Compromised Accounts

Attackers often use email rules as a means of establishing persistence within a compromised account, allowing them to monitor or manipulate communications even after initial detection and remediation efforts.

• Hidden Forwarding Rules: Once an account is compromised, an attacker can create hidden forwarding rules that are difficult to detect and that continue to operate even if the user changes their password. This ensures continuous access to incoming emails.
• Auto-Deletion or Auto-Archiving: Rules that automatically delete or archive emails containing specific keywords (such as “suspicious activity” or “account compromise”) can hinder incident response efforts by keeping alerts from reaching the user or IT team.

5. Amplifying Phishing and Malware Spread

Risky email rules can be used to spread phishing links or malware attachments to other users within the organization.

• Auto-Reply Rules with Malicious Content: Users or attackers might configure auto-reply rules to automatically respond to incoming emails with phishing links or malware. This can propagate the attack within the organization, especially if internal emails are trusted.
• Forwarding Rules to Internal Groups: Attackers can also use forwarding rules to distribute malicious content to entire distribution groups. By targeting high-traffic inboxes, they increase the likelihood of successful phishing attempts or malware infections.

6- Bypassing Email Security Controls

Email rules can sometimes bypass organizational security controls, allowing attackers to exploit vulnerabilities that the organization’s email security system would otherwise block.

• Bypassing Filters: Users might create rules that automatically mark emails as “safe” or move them to folders that bypass spam or phishing filters, undermining security policies set by IT.
• Custom Rule Creation on Compromised Accounts: Once attackers gain access to a user’s email, they might create custom rules that circumvent spam filters by renaming phishing emails or moving them to trusted folders, thus avoiding detection by automated tools.

---

Mitigation Strategies for IT Professionals:

1. Implement Conditional Access and MFA: Multi-factor authentication (MFA) and conditional access policies can reduce the risk of compromised accounts being used to create malicious email rules.
2. Audit and Monitor Email Rules: Regularly audit email rules in users’ accounts for suspicious configurations, such as hidden forwarding rules or auto-replies with external recipients.
3. Restrict Automatic Forwarding to External Domains: Enforce policies that prevent or limit automatic forwarding to external email addresses, especially from accounts with access to sensitive data.
4. Train Users on Phishing and Security Risks: Educate users on the risks of risky email rule behaviors and provide them with guidance on securely managing their email rules.
5. Leverage Security Tools for Anomaly Detection: Utilize tools like Microsoft Defender for Office 365 to detect anomalous email rule changes or suspicious activity associated with compromised accounts.
6. Configure DLP and Anti-Phishing Policies: Use DLP and anti-phishing policies that detect and alert on unusual email behavior, such as bulk forwarding or rule creation, to minimize the potential impact of risky email rule configurations.

By understanding and addressing these risky behaviors, IT professionals can strengthen email security and mitigate the risks associated with user-created email rules.