O365 Suspicious Admin Email Forwarding

Description

This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination.

   Search

Open in Search