Insider Threat Matrix™Insider Threat Matrix™
  • ID: DT145
  • Created: 17th September 2025
  • Updated: 17th September 2025
  • Contributor: The ITM Team

Microsoft Exchange, Auto Forwarded Message Report

Within the Exchange Admin Center, under Reports > Mail flow, there is a pre-built report named “Auto forwarded message report”. This provides information about automated forwarding of emails to external domains, and is a useful resource to proactively identify potential data leakage.

 

This report includes a table with the following properties:

  • Forwarders: The local mailbox that is forwarding emails externally.
  • Forwarding Type: The method used for automatically forwarding emails, including Mailbox Rule (configured by a user in the context of that mailbox), or SMTP Forwarding (configured by an administrator for that mailbox).
  • Recipient Name: The mailbox friendly name or actual mailbox that is recieiving forwarded emails.
  • Recipient Domain: The domain of the recipient mailbox.
  • Forward Count: The number of emails forwarded between the Forwarder and Recipient in the timeframe the report is scoped to.

Sections

ID Name Description
PR040.001Testing Data Transfer Controls

A subject conducts a limited transfer of non-sensitive or low-value data to determine whether organizational controls detect, block, quarantine, or escalate the activity.

 

The subject may send a file to a personal email account, upload content to an unapproved cloud storage service, transfer data through a messaging platform, or use another external destination before attempting a larger or more sensitive transfer. They may vary the file type, size, classification, destination, compression, encryption, or transfer method to identify which conditions trigger Data Loss Prevention (DLP), web proxy, email gateway, or cloud access security controls.

 

The behavior may include a pause after the test while the subject waits to determine whether security personnel, management, or another authority responds. A successful test may establish a viable exfiltration route or reveal thresholds that can be avoided during a later infringement.