Evasion Inbox Rule Creation Following Unmanaged Login

Bryant Smith@flowstate

•updated Jun 1, 2026•5•0•38

Detects a successful login from a non-compliant, unmanaged device followed by an inbox rule creation or modification within 10 minutes. This sequence aligns with post-compromise evasion tactics observed in device code phishing campaigns like Kali365, where attackers quickly suppress security alerts after gaining access.