Microsoft 365: Creation of External Forwarding/Redirect Rule in Exchange

The user {user} has created a new inbox rule named {name} in their Microsoft 365 account, with reference to {recipients}. Many times compromised accounts will create inbox rules to lengthen the amount of time before the compromise is detected. These rules will sometimes remove email from sent folders or delete all incoming messages to the victim's mailbox. Affected User: {'[]':user:5:'(user undefined in log data)'} User Type: {'[]':account_type:5:'(account_type undefined in log data)'} Client IP: {'[]':client_ip:5:'(client_ip undefined in log data)'} Mail Rule Name: {'[]':name:5:'(name undefined in log data)'} Forwarded/Redirected To: {'[]':recipients:5:'(recipients undefined in log data)'}