Adversaries may setup email forwarding rules to collect sensitive information.

Tactics
TA0009

Sub-technique of
T1114


See: MITRE ATT&CK