How to Investigate a Security Alert Involving a New Email Forwarding Rule

A newly created forwarding rule may be a legitimate workflow or a way to quietly copy business messages outside the organization. The rule can be hidden in mailbox settings and remain active after a password reset.

What to check

Identify who created the rule, its destination, creation time, account sign-ins, mailbox audit events, and any matching business approval. Review inbox rules and provider-side forwarding settings, not only the user’s visible client.

Recommended next step

If unauthorized, disable the forwarding path, revoke active sessions, preserve audit evidence, and follow the incident process to assess exposed messages. Verify that the account owner can still receive legitimate mail.

How Informatix Systems can help

Informatix Systems provides security operations and incident response services. We can assess the affected systems, clarify likely causes, and help plan a practical fix. Contact us with the platform involved, when the issue began, and non-sensitive error details.