Healthcare Data Breach Settlement: Anatomy of the Physicians Primary Care Compromise & Defense

---
title: Suspicious Mailbox Forwarding Rule Creation
id: 8c2d1e4f-9a3b-4f5c-8d1e-4f9a3b4f5c8d
status: experimental
description: Detects the creation of inbox rules that forward emails to external recipients, a common persistence mechanism in email compromises.
references:
  - https://attack.mitre.org/techniques/T1114/003/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1114.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
    CommandLine|contains:
      - 'ForwardTo'
      - 'RedirectTo'
      - 'CopyToFolder'
  condition: selection
falsepositives:
  - Legitimate administrative configuration of forwarding rules
level: high
---
title: Suspicious Outlook PST Export Activity
id: 9d3e2f5a-0b4c-5g6d-9e3e-2f5a0b4c5g6d
status: experimental
description: Detects Microsoft Outlook attempting to export mailbox data to PST files, which may indicate manual data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.exfiltration
  - attack.t1560
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\outlook.exe'
    CommandLine|contains:
      - 'pst'
      - 'export'
  condition: selection
falsepositives:
  - Users performing legitimate backups of their mailbox
level: medium
---
title: PowerShell Exchange Online Connection
id: 1a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects PowerShell scripts connecting to Exchange Online Management modules, often used for bulk data extraction.
references:
  - https://attack.mitre.org/techniques/T1078/004/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.defense_evasion
  - attack.t1078.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Connect-ExchangeOnline'
      - 'New-ManagementGroupSession'
  condition: selection
falsepositives:
  - Administrators performing routine Exchange management
level: low

OfficeActivity
| where Operation in ("New-InboxRule", "Set-InboxRule")
| extend Parameters = parse_(Parameters)
| mv-apply Parameter = Parameters on 
    (
        where Parameter.Name == "ForwardTo" or Parameter.Name == "RedirectTo"
        project ForwardTo = Parameter.Value
    )
| where isnotempty(ForwardTo)
| project TimeGenerated, UserId, Operation, ForwardTo, ClientIP
| extend DomainName = tostring(split(ForwardTo, "@")[1])
| where DomainName !contains "@yourdomain.com" // Filter internal domains
| order by TimeGenerated desc

-- Hunt for recently modified PST files in user directories
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="\\Users\\*\\*.pst", root="/")
WHERE Mtime > timestamp(now) - duration("7d")
   OR Size > 1024 * 1024 * 50 -- Greater than 50MB

# Connect to Exchange Online
# Connect-ExchangeOnline

# Get all mailboxes with forwarding enabled
$ForwardingMailboxes = Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ForwardingSmtpAddress -ne $null }

if ($ForwardingMailboxes) {
    Write-Host "[ALERT] Found mailboxes with external forwarding enabled:" -ForegroundColor Red
    foreach ($mailbox in $ForwardingMailboxes) {
        [PSCustomObject]@{
            User            = $mailbox.UserPrincipalName
            ForwardingAddress = $mailbox.ForwardingSmtpAddress
            DeliverToMailbox = $mailbox.DeliverToMailboxAndForward
        }
    }
} else {
    Write-Host "[INFO] No external forwarding rules detected." -ForegroundColor Green
}

# Check for Inbox Rules
$Mailboxes = Get-Mailbox -ResultSize Unlimited
foreach ($mbx in $Mailboxes) {
    $rules = Get-InboxRule -Mailbox $mbx.Identity
    foreach ($rule in $rules) {
        if ($rule.ForwardTo -or $rule.RedirectTo -or $rule.CopyToFolder) {
            Write-Host "[ALERT] Suspicious rule found in $($mbx.UserPrincipalName): $($rule.Name)" -ForegroundColor Yellow
        }
    }
}