Kali365 - External Exchange Forwarding Setup (T1114.003)
Identifies the creation of an Exchange transport rule or mailbox setting that forwards all incoming emails to an external, attacker-controlled address.
Microsoft Sentinel (KQL)
Identifies the creation of an Exchange transport rule or mailbox setting that forwards all incoming emails to an external, attacker-controlled address.
Already have an account?