Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet

{
  "selection_cmdlet": {
    "ScriptBlockText
| contains": [
      "New-InboxRule",
      "Set-InboxRule",
      "Set-Mailbox"
    ]
  },
  "selection_params": {
    "ScriptBlockText
| contains": [
      "ForwardAsAttachmentTo",
      "ForwardingAddress",
      "ForwardingSmtpAddress",
      "ForwardTo",
      "RedirectTo"
    ]
  },
  "condition": "all of selection_*"
}

False Positives

• ⚠ Legitimate mail forwarding rules created by users or administrators to forward email to designated internal or external recipients for business or operational purposes.