Detecting & Stopping Hidden Mailbox Forwarding Rules in Microsoft 365: PowerShell Threat Hunting Runbook (2026)
🛡️ 30-Second Fast Triage: One-Line Tenant Forwarding Audit Zero-Trust SecOps Audit Both Mailbox Forwarding AND Client Inbox Rules: Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ForwardingAddress -ne $null -or $_.ForwardingSmtpAddress -ne $null } | Select-Object DisplayName, UserPrincipalName, ForwardingSmtpAddress, DeliverToMailboxAndForward Note: Forwarding happens at TWO levels: (1) Mailbox properties (above) and (2) Client-side Inbox Rules (e.g. Get-InboxRule)….
