O365 BEC Email Hiding Rule Created

This analytic detects the creation or modification of mailbox rules in Office 365, a technique commonly used in Business Email Compromise (BEC) attacks to hide malicious emails. It uses a scoring mechanism based on attributes like rule name entropy, name length, 'MarkAsRead' action, and 'MoveToFolder' destination to identify suspicious rules. A high score indicates a potential attacker has gained access to the account and is attempting to conceal their activities or exfiltrate information.