Email Forwarding Rule Set via Office 365 Graph API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to create or modify email forwarding rules in Office 365 via the Microsoft Graph API. Specifically, it looks for HTTP POST requests to the '/mailFolders/inbox/messageRules' endpoint on 'graph.microsoft.com'. This activity can indicate an attacker setting up an inbox rule to forward emails to an external address for data exfiltration or to maintain persistence.