Inbox rule changes which forward-redirect email

id: 54569b06-47fc-41ae-9b00-f7d9b61337b6
name: Inbox rule changes which forward-redirect email
description: |
  This query helps hunting for Inbox rule changes which forward-redirect email
description-detailed: |
  This query helps hunting for Inbox rule changes which forward-redirect email
  Reference - https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-outlook-rules-forms-attack#what-is-the-outlook-rules-and-custom-forms-injection-attack
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - Persistence
relevantTechniques:
  - T1098
query: |
  CloudAppEvents
  | where ActionType contains "Set-InboxRule"
  |extend Parameters = tostring((parse_json(RawEventData)).Parameters)
  |where Parameters contains "ForwardTo" or Parameters contains "RedirectTo"
version: 1.0.0