Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet

{
  "ps_script": {
    "EventID": 4104,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection_cmdlet": {
    "ScriptBlockText
| contains": [
      "New-InboxRule",
      "Set-InboxRule",
      "Set-Mailbox"
    ]
  },
  "selection_params": {
    "ScriptBlockText
| contains": [
      "ForwardAsAttachmentTo",
      "ForwardingAddress",
      "ForwardingSmtpAddress",
      "ForwardTo",
      "RedirectTo"
    ]
  },
  "condition": "ps_script and (all of selection_*)"
}

False Positives

• ⚠ Legitimate mail forwarding rules created by users or administrators to forward email to designated internal or external recipients for business or operational purposes.