Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain persistent access to email communications for intelligence collection and business email compromise. Use when hunting for suspicious auto-forwarding, hidden mailbox rules, or T1114-style email collection persistence after a compromised account or BEC incident.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-email-forwarding-rules-attacknpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-email-forwarding-rules-attack -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-email-forwarding-rules-attack -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-email-forwarding-rules-attackgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-email-forwarding-rules-attackgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-email-forwarding-rules-attack ~/.claude/skills/detecting-email-forwarding-rules-attack # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-email-forwarding-rules-attack ~/.agents/skills/detecting-email-forwarding-rules-attack # Codex, Cursor, Gemini CLI, Copilot, OpenCode