Exchange Transport Rule Created or Modified
Detects the creation, modification, enabling, or removal of Microsoft Exchange transport rules. Transport rules operate at the organization level, allowing attackers with administrative privileges to create rules that redirect, copy, or delete mail across the entire organization.
Cortex XDR
