Compromised O365 Account Internal Spearphishing and Forwarding Rule Abuse
Detects potentially malicious activity within Microsoft 365 involving the creation of inbox rules for message forwarding/redirection, modifications to mailbox forwarding configurations, or mass outbound email sending. These actions are common indicators of persistent access, email exfiltration, or automated reconnaissance after account compromise.
Splunk (SPL)
