Detections
Analytics

MS.EXO.1.1v2 - Automatic forwarding to external domains SHALL be disabled.

Information

Adversaries can use automatic forwarding to gain persistent access to a victim's email. Disabling forwarding to external domains prevents this technique when the adversary is external to the organization but does not impede legitimate internal forwarding.

Solution

To disallow automatic forwarding to external domains:

1. Sign in to the Exchange admin center.

2. Select Mail flow, then Remote domains.

3. Select Default.

4. Under Email reply types, select Edit reply types.

5. Clear the checkbox next to Allow automatic forwarding, then
 click Save.

6. Return to Remote domains and review each
 additional remote domain in the list, ensuring that automatic forwarding
 is only allowed for approved domains.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4

Plugin: microsoft_azure

Control ID: ee9936b10a4bd9273f71f88c5504f7c5639aaee318f2d63b8b36fb6fa391bcb7