Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet
Read the full analysis on IntelFusions