Detecting mailbox forwarding rule creation events

This query identifies different types of mailbox forwarding rule creation events within the organization.

Microsoft Sentinel (KQL)