Update microsoft365_susp_email_forwarding_activity.yml

SigmaHQ · Nov 17, 2024 · d46ae6d · d46ae6d
1 parent 37fb2da
commit d46ae6d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml b/rules-threat-hunting/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml
@@ -33,11 +33,11 @@ detection:
             - 'New-InboxRule'
             - 'Set-InboxRule'
         Parameters|contains:
-            - 'ForwardTo'
             - 'ForwardAsAttachmentTo'
-            - 'RedirectTo'
             - 'ForwardingAddress'
             - 'ForwardingSmtpAddress'
+            - 'ForwardTo'
+            - 'RedirectTo'
             - 'RedirectToRecipients'
     condition: 1 of selection_*
 falsepositives: