Mail Forwarding/Redirecting Activity In O365

{
  "selection_updateinbox": {
    "Operation
| contains": "UpdateInboxRules",
    "OperationProperties
| contains": [
      "Forward",
      "Recipients"
    ]
  },
  "selection_setmailbox": {
    "Operation
| contains": "Set-Mailbox",
    "Parameters
| contains": [
      "ForwardingSmtpAddress",
      "ForwardingAddress"
    ]
  },
  "selection_setinbox": {
    "Operation
| contains": [
      "New-InboxRule",
      "Set-InboxRule"
    ],
    "Parameters
| contains": [
      "ForwardAsAttachmentTo",
      "ForwardingAddress",
      "ForwardingSmtpAddress",
      "ForwardTo",
      "RedirectTo",
      "RedirectToRecipients"
    ]
  },
  "condition": "1 of selection_*"
}

False Positives

• ⚠ False positives are expected from legitimate mail forwarding rules. You need organisation specific knowledge. Filter out the domains that are allowed as forwarding targets as well as any additional metadata that you can use for exclusion from trusted sources/targets in order to promote this to a potential detection rule.