Exchange Online mailbox with SMTP forwarding address

This configuration is rated informational severity because it indicates a potential means for threat actors to receive emails from compromised mailboxes, but does not directly enable compromise or administrative access. The attacker gains the ability to intercept and redirect emails, which can support later attacker activity such as reconnaissance and persistence.

Attackers might use an Exchange Online mailbox with an SMTP forwarding address to receive emails from a compromised mailbox, allowing them to gather information. This configuration can serve as a means for threat actors to maintain persistence and support later attacker activity such as lateral movement.

Cayosoft Guardian continuously monitors the configuration of email accounts in the organization's Microsoft 365 environment, identifying and flagging any instances where an SMTP forwarding address is set. This allows administrators to take proactive measures to prevent potential security issues.

Cayosoft Guardian alerts administrators to the presence of SMTP forwarding addresses, enabling them to review and remove any unnecessary or potentially malicious configurations. This proactive approach supports ongoing security by providing visibility into potential attack paths and assisting response efforts.