Suspicious Inbox Rule Modification
Detects the creation or modification of inbox rules in Exchange, which OilRig uses to hide and manage their steganographic email C2 communications.
Microsoft Sentinel (KQL)
Detects the creation or modification of inbox rules in Exchange, which OilRig uses to hide and manage their steganographic email C2 communications.
Already have an account?