How to Audit Microsoft 365 Mailboxes for Hidden Forwarding Rules
When a business mailbox gets compromised, resetting the password is only half the job. Attackers often leave behind forwarding rules that quietly copy every new email to an outside address, even after the password has changed. This guide shows how to audit for those leftovers in Microsoft 365 using PowerShell. Common persistence tricks after account takeover: Inbox rules that forward or redirect mail externally Mailbox-level forwarding (ForwardingSmtpAddress) Rules that move replies to hidden fo
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.