Suspicious Inbox Manipulation Rules
Detects suspicious inbox manipulation rules that are set on a user's mailbox to delete or move messages or folders. This often indicates an attacker is trying to hide their activities or exfiltrate data by automatically moving emails.
Sigma
