M365 Rapid Email Move To Deleted Items
Detects a high volume of emails being moved to the 'Deleted Items' folder from the 'Inbox' or 'Sent Items' folders by a single user in a short timeframe. This behavior is a known tactic used by threat actors, such as the 'Jingle Thief' group (CL-CRI-1032/Atlas Lion), to hide malicious activities like internal phishing by deleting the sent messages and any replies.
YARA-L
