detecting-email-forwarding-rules-attack

Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain persistent access to email communications for intelligence collection and business email compromise. Use when hunting for suspicious auto-forwarding, hidden mailbox rules, or T1114-style email collection persistence after a compromised account or BEC incident.

Install

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• agentmail 113,505 ★
  Use your assigned AgentMail inbox to read email tasks, explicitly send or reply, and check delivery. Provided
• orbit-gmail 107,550 ★
  Open Orbit briefing skill — selected by the Orbit pipeline when Gmail is the user's only connected connector,
• agent-mail-automation 79,451 ★
  Automate Agent Mail tasks via Rube MCP (Composio). Always search tools first for current schemas.
• sendgrid-automation 49,672 ★
  Automate SendGrid email delivery workflows including marketing campaigns (Single Sends), contact and list mana
• email-drafter 41,140 ★
  Draft and review professional emails that match your personal writing style. Analyzes your sent emails for ton