Email Security
ForwardWatch
Detect unauthorized email forwarding rules
Scans mailbox forwarding configurations to find rules that silently copy emails to external addresses — a favorite persistence technique for attackers who have compromised an account.
Key Features
Forwarding rule scanner
External address detection
Historical rule comparison
Bulk mailbox scanning
Alert on new rules
Remediation guidance
Benefits
1
Catch attacker persistence via email forwarding
2
Find shadow forwarding rules you did not authorize
3
Protect against data exfiltration via email
Use Cases
Post-compromise investigation
Email security auditing
Insider threat detection