Detecting Mailbox Forwarding Rules Created for High-Risk Users
This query detects mailbox forwarding rules created for specified users, such as high-risk users. Attackers don’t always target random mailboxes. They often prioritize accounts with access to valuable information, such as executives, finance teams, legal departments, HR personnel, and security leaders. By creating mailbox forwarding rules on these high-value accounts, attackers can quietly monitor sensitive communications and collect intelligence while remaining unnoticed.
Microsoft Sentinel (KQL)
