<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Email Forwarding Abuse

## Exchange Online — Inbox Rules

```powershell
# List forwarding rules for a mailbox
Get-InboxRule -Mailbox user@example.com | Where-Object { $_.ForwardTo -or $_.RedirectTo }

# Scan all mailboxes
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.UPN | Where-Object { $_.ForwardTo -match "SMTP:" }
}
```

## Exchange Online — Unified Audit Log

```powershell
Search-UnifiedAuditLog -Operations "New-InboxRule","Set-InboxRule" -StartDate (Get-Date).AddDays(-30)
```

## Agent Script

```bash
node agent.js analyze-rules --rules rules_export.txt --org-domain example.com
node agent.js check-audit --log audit_log.txt
node agent.js generate-queries --org-domain example.com
```
