Most Popular Detection 2026: Suspicious Inbox Forwarding Rule to External Domain (BEC)
Detects the creation or modification of Exchange Online inbox rules that configure automatic email forwarding or redirection to an external domain. The rule specifically flags if the action also involves deleting or hiding the message, which is a common persistence and exfiltration technique used in Business Email Compromise (BEC) attacks. The detection also incorporates correlation with recent high-risk sign-in activity for the associated user account.
Microsoft Sentinel (KQL)
