value:  Information-motivated groups may use previously-compromised email credentials to set up email forwarding rules on multiple compromised accounts in attempts to cast a wide net to steal valuable data. 
name: Email Collection: Email Forwarding Rule