Exchange Inbox Rule Creation for Alert Suppression
Detects the creation or modification of Exchange inbox rules used by Kali365 designed to suppress security alerts by moving, deleting, or marking as read emails containing specific keywords. This technique is often used by adversaries to hide their activities or prevent detection.
Microsoft Sentinel (KQL)
