Detect Email Forwarding Creation Attempts Outside of Organization

// Discover email forwarding creation attempts outside of your organization.

Microsoft Sentinel (KQL)