diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml
index fc9e0b611f..1f260b8963 100644
--- a/detections/cloud/o365_pst_export_alert.yml
+++ b/detections/cloud/o365_pst_export_alert.yml
@@ -21,6 +21,7 @@ references:
 tags:
   analytic_story:
   - Office 365 Detections
+  - Data Exfiltration
   asset_type: Office 365
   automated_detection_testing: passed
   dataset:
diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml
index ff1d16a23d..9a5d5b3ea6 100644
--- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml
+++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml
@@ -19,6 +19,7 @@ references: []
 tags:
   analytic_story:
   - Office 365 Detections
+  - Data Exfiltration
   asset_type: Office 365
   automated_detection_testing: passed
   cis20:
diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml
index 8ee80587ff..698a76fd93 100644
--- a/detections/cloud/o365_suspicious_user_email_forwarding.yml
+++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml
@@ -19,6 +19,7 @@ references: []
 tags:
   analytic_story:
   - Office 365 Detections
+  - Data Exfiltration
   asset_type: Office 365
   automated_detection_testing: passed
   cis20:
diff --git a/tests/cloud/o365_suspicious_user_email_forwarding.test.yml b/tests/cloud/o365_suspicious_user_email_forwarding.test.yml
new file mode 100644
index 0000000000..523580ad04
--- /dev/null
+++ b/tests/cloud/o365_suspicious_user_email_forwarding.test.yml
@@ -0,0 +1,12 @@
+name: O365 Suspicious User Email Forwarding Unit Test
+tests:
+- name: O365 Suspicious User Email Forwarding
+  file: cloud/o365_suspicious_user_email_forwarding.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: o365_email_forwarding_rule.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule/o365_email_forwarding_rule.json
+    sourcetype: 'o365:management:activity'
+    source: 'o365'