Suspicious Inbox Forwarding Rule Detected by Microsoft Cloud App Security
Detects when Microsoft Cloud App Security reports suspicious email forwarding rules, such as a user creating an inbox rule to forward copies of all emails to an external address. This activity can indicate an attempt to exfiltrate sensitive information.
Sigma
