Detects email forwarding or redirecting activity in O365 Audit logs.
Read the full analysis on IntelFusions