O365 Suspicious User Email Forwarding

Description

This search detects when multiple user configured a forwarding rule to the same destination.

   Search

Open in Search