Suspicious Inbox Forwarding — Detection Rule

Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

Read the full analysis on IntelFusions