Question

At Contoso, several user mailboxes were recently compromised and attackers created inbox rules that automatically forwarded mail to external addresses. The security team wants to be notified automatically whenever Defender for Office 365 detects that a user has set up suspicious external email forwarding, without writing custom KQL. What should you configure in the Microsoft Defender portal?

Accepted Answer

An alert policy in the Microsoft Defender portal that triggers on the built-in 'Suspicious email forwarding activity' activity

Answer

A mail flow (transport) rule in the Exchange admin center that blocks all outbound forwarding

Answer

A custom detection rule using an advanced hunting query against the EmailEvents table

Answer

An anti-phishing policy with mailbox intelligence impersonation protection enabled