Add email auto-forwarding hunting queries (exfiltration)

[DanielM (damozes1)]

Adds four hunting queries using the EmailEvents table that surface automatic external email forwarding (mailbox rule and SMTP forwarding), a common data-exfiltration technique after mailbox compromise:

• Automatic external email forwarding overview by type
• Top internal users auto-forwarding email externally
• Top external domains receiving auto-forwarded email
• Top external recipients receiving auto-forwarded email

Each query is added in both the Hunting Queries area and the Microsoft Defender XDR solution with its own unique id.

Change(s):

• Four new hunting query .yaml files under "Email and Collaboration Queries/Mailflow", in both the Hunting Queries and the Microsoft Defender XDR Solution locations.

Reason for Change(s):

• Surfaces automatic external email forwarding (mailbox rule and SMTP), split by type, user, external domain and external recipient. No equivalent forwarding queries exist in the repo.

Version Updated:

• N/A. Hunting queries, not Detection/Analytic Rule templates.

Testing Completed:

• Yes. All four queries were run in Advanced Hunting and return results.

Checked that the validations are passing and have addressed any issues that are present:

• Yes.

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Pull request overview

Adds new Advanced Hunting queries to help identify automatic external email forwarding activity (mailbox rule and SMTP forwarding) as a potential data exfiltration technique.

Changes:

• Adds an overview query summarizing external auto-forwarding volume by forwarding type.
• Adds three “top N” queries to rank internal forwarders, external recipient domains, and external recipient addresses.
• Duplicates each query into both the Hunting Queries area and the Microsoft Defender XDR solution location with unique IDs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
Solutions/Microsoft Defender XDR/Hunting Queries/Email and Collaboration Queries/Mailflow/Automatic External Email Forwarding by Type.yaml	Adds tenant-level aggregation of auto-forwarded outbound email by forwarding type.
Solutions/Microsoft Defender XDR/Hunting Queries/Email and Collaboration Queries/Mailflow/Top Users Auto-forwarding Email Externally.yaml	Adds ranking of internal users auto-forwarding to external recipients by type.
Solutions/Microsoft Defender XDR/Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Domains Receiving Auto-forwarded Email.yaml	Adds ranking of external recipient domains receiving auto-forwarded mail by type.
Solutions/Microsoft Defender XDR/Hunting Queries/Email and Collaboration Queries/Mailflow/Top External Recipients Receiving Auto-forwarded Email.yaml	Adds ranking of external recipient addresses receiving auto-forwarded mail by type.
Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/Automatic External Email Forwarding by Type.yaml	Same overview query as above for the non-solution hunting queries location (unique id).
Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/Top Users Auto-forwarding Email Externally.yaml	Same “top users” query as above for the non-solution location (unique id).
Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/Top External Domains Receiving Auto-forwarded Email.yaml	Same “top domains” query as above for the non-solution location (unique id).
Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Mailflow/Top External Recipients Receiving Auto-forwarded Email.yaml	Same “top recipients” query as above for the non-solution location (unique id).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[DanielM (damozes1)]

v-atulyadav On the KqlValidations failure (KS142 on ForwardingInformation): this is a valid, current EmailEvents column (it backs the Inbox-rule / SMTP external-forwarding insights) that isn't in the offline validation schema bundled with the tests yet, so the analyzer flags it as unknown. The queries run correctly against a live tenant.
As a stopgap I added the four template IDs (Hunting Queries + Solution copies) to SkipValidationsTemplates.json following the existing pattern; the suite is green locally with that change.
Longer term it'd be worth refreshing the validator's EmailEvents schema at the source — several columns added to EmailEvents and other MDO tables over the past year will hit the same false negative until the bundled schema is updated. Happy to help.