Suspicious Inbox Forwarding Rule Detected by Identity Protection
This rule detects suspicious inbox forwarding rules, specifically those that forward a copy of all emails to an external address. This behavior is often indicative of an attacker attempting to exfiltrate sensitive information from a compromised mailbox.
Sigma
