Exchange Inbox Rule Forwarding Email to External Domain (T1114.003)
Detects the creation or modification of inbox rules in Office 365/Exchange that configure email forwarding or redirection to external domains. Attackers often use these rules to exfiltrate email data or maintain persistence within an environment by redirecting communications to attacker-controlled accounts.
Microsoft Sentinel (KQL)
