Mailbox forwarding rules audit script idea
Overview
Silent external forwards exfiltrate mail post-BEC. Audit regularly—even if UI-only initially.
What to look for
ForwardingSMTPAddress, inbox rules hiding forwards, delegate permissions oddities.
Execution cadence
Monthly automated report to security DL; Sev1 if bulk forwards to freemail appear.
PowerShell sketch (EXO)
Connect-ExchangeOnline → Get-Mailbox -ResultSize Unlimited | Get-MailboxForwarding ... per MS docs—test throttle.
Governance
Change ticket required for any external auto-forward going forward.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...