Tycoon Victim Session Creates a New Mail Forwarding Rule
Detects a mail forwarding or redirect rule created from a session that recently exhibited token replay or unusual client changes. This rule specifically looks for operations related to Inbox Rules in Exchange or Office 365 audit logs that contain keywords indicating forwarding or redirection.
Microsoft Sentinel (KQL)
