Detecting Multiple Mailboxes Forwarding to the Same External Email Address
This query detects when three or more user mailboxes are configured to forward email to the same external email address.
Microsoft Sentinel (KQL)

This query detects when three or more user mailboxes are configured to forward email to the same external email address.

Already have an account?