- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Detect when a user sets up a mail forwarding rule to another email address. An adversary or insider threat could set a forwarding rule to forward all emails to an external email address.
Monitor Microsoft 365 audit logs to look for events with @evt.name
value of Set-Mailbox
, where a value is set for @Parameters.ForwardingSmtpAddress
and the @evt.outcome
is True
.
@Parameters.ForwardingSmtpAddress
for {{@usr.email}}
to see if it is sending email to an external non-company owned domain.{{@usr.email}}
is not aware of the mail forwarding rule, investigate all {{@usr.email}}
accounts for anomalous activity.