Exchange Mailbox Rule Creation or Modification to External Address

Erik van Kruiselbergen@RideMeUp

•updated May 28, 2026•12•0•24

This rule detects the creation or modification of Exchange transport rules or inbox rules that forward or redirect emails to external domains. It specifically looks for operations like 'New-TransportRule', 'Set-TransportRule', 'New-InboxRule', 'Set-InboxRule', 'Set-Mailbox', 'UpdateInboxRules', and 'Set-TransportConfig' where the destination is an email address outside of the organization's verified domains. This activity can indicate data exfiltration or an attempt to maintain persistence and collect sensitive information.