Office 365 Inbox Rule Creation for Email Forwarding
Detects the creation or modification of inbox rules in Office 365 that involve automatic email forwarding, redirection, or deletion. Such rules are commonly created by adversaries to exfiltrate email data or maintain persistent access to a compromised mailbox.
Microsoft Sentinel (KQL)
