KQL - External Mail Forwarding & Mailbox Permission Changes
Identifies potentially suspicious email forwarding configurations, mailbox permission assignments, transport rule changes, and delegate access grants that could enable unauthorized email access or data exfiltration. The query correlates multiple Microsoft 365 audit activities including: Inbox forwarding rules SMTP mailbox forwarding Transport rule forwarding Delegate mailbox access assignments Removed or disabled forwarding configurations This helps detect common Business Email Compromise (BEC) techniques where attackers establish persistence by forwarding mail to external addresses or granting unauthorized mailbox access.
Microsoft Sentinel (KQL)
