Mail forwarding rules can keep intruders collecting email after a password reset

Standard incident response of changing a password and revoking sessions does not remove mail forwarding rules that an intruder added to a compromised mailbox. Such rules are configuration settings rather than credentials, so they keep copying incoming messages to an attacker-controlled address after the password is replaced. The technique is catalogued by MITRE ATT&CK under email collection and appears frequently in intrusion reports. The article recommends that responders enumerate and remove forwarding rules, external delegates, and other automatic processing on affected mailboxes as a routine step. It also suggests monitoring for suspicious rules, such as external destinations or rules that delete or hide messages, and logging configuration changes alongside sign-in events.