https://research.splunk.com/cloud/68469fd0-1315-44ba-b7e4-e92847bb76d6/
Detection: O365 New Email Forwarding Rule Created | Splunk Security Content
Apr 15, 2026 - Updated Date: 2026-04-15 ID: 68469fd0-1315-44ba-b7e4-e92847bb76d6 Author: Mauricio Velazco, Splunk Type: TTP Product: Splunk Enterprise Security Description...
email forwarding ruledetectionnewcreatedsplunk