Detecting "Evil" Exchange Mail Rule Logic

Daniel Miller@dxmiller

•updated Feb 2, 2026•17•0•128

This query parses the complex JSON parameters of the New-TransportRule and Set-TransportRule commands to find instances where email is being secretly copied externally or security is being lowered.