Suspicious Exchange Inbox Rule Creation

Identifies potentially malicious inbox rules used to hide emails, forward messages externally, or facilitate business email compromise activity.

Microsoft Sentinel (KQL)