How to Investigate an Unexpected Email Rule That Forwards Messages Externally

An external forwarding rule can persistently copy messages beyond the organization without obvious mailbox activity.

Checks to make

Preserve the rule and audit history, identify who created it and when, review sign-ins and mailbox actions, and assess data exposure. Remove or disable it under response procedures, revoke suspicious sessions, and check for similar rules elsewhere.

When to get help

Incident response can investigate mailbox activity and contain forwarding. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.