Email Auto-Forward Rule Created via Exchange

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects the creation of an email auto-forwarding rule within Microsoft Exchange via the Exchange Web Services (EWS) interface. It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing the string 'ForwardToRecipients' in the client body, indicating an attempt to configure email forwarding.