OWA Email Read Immediately Followed By Inbox Rule Change
Detects a temporal pattern characteristic of CVE-2026-42897 XSS exploitation: an OWA user reads a message (via Bind, OpenMessage, or similar EWS/OWA endpoints), and within 60 seconds, the same session issues a POST request to create or modify an inbox rule. This rapid succession from the same session cookie indicates programmatic action (XSS-driven JavaScript) rather than human-driven workflow. The rule correlates events by client IP and username within a 60-second window.
CQL
