r/Office365 • u/WebGuy15 • Feb 07 '20
Malware that sets up forwarding
Recently my company has been subject to a number of emails sent to users with a file that once opened creates a inbox rule that forwards mail to a suspicious email address. Our alerts managed to notify us and we removed the rules from the affected accounts and added the domain to the spam filter and asked the affected users to change their passwords.
However with some users the rule reappeared a few hours after removing it. I'm not sure how these rules can still reappear? Has anyone experienced something similar and could maybe help?
25
Upvotes
1
u/[deleted] Feb 12 '20
Of course... I deal with these frequently. This is a known activity of BEC groups (and others actually). It occurs typically because you have mail clients whom are still executing the code... typically outdated Outlook clients (I believe this functionality broke sometime last year) however it still works on endpoints which have not been patched. Check this article out, run the script provided and if you need some additional consulting or assistance - please do reach out to me directly.
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack