- 重要な情報
- アプリ内
- インフラストラクチャー
- アプリケーションパフォーマンス
- 継続的インテグレーション
- ログ管理
- セキュリティ
- UX モニタリング
- 管理
Detect when a user sets up a mail forwarding rule to another email address. An adversary or insider threat could set a forwarding rule to forward all emails to an external email address.
Monitor Microsoft 365 audit logs to look for events with @evt.name
value of Set-Mailbox
, where a value is set for @Parameters.ForwardingSmtpAddress
and the @evt.outcome
is True
.
@Parameters.ForwardingSmtpAddress
for {{@usr.email}}
to see if it is sending email to an external non-company owned domain.{{@usr.email}}
is not aware of the mail forwarding rule, investigate all {{@usr.email}}
accounts for anomalous activity.