All Detections

Detecting Mailbox Forwarding After a Security Alert

avatar
Bi Yue Xu@biyuexu
updated Sep 13, 20264011

This KQL query identifies a user who is flagged in a security alert then creates a mailbox forwarding rule within a defined time window.

Microsoft Sentinel (KQL)