Suspicious Login Followed by Destructive Inbox Rule

Bryant Smith@flowstate

•updated Jun 3, 2026•15•1•27

Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.