Multiple Email Forwarding Rules Created

Ankit Mehta@Secvyn

•updated Jun 13, 2026•1•0•3

This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.