Inbox Rule Created to Hide Phishing Replies

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the creation of a new inbox rule via Exchange Web Services (EWS) that could be used to hide phishing replies. Specifically, it looks for HTTP traffic to '/EWS/Exchange.asmx' with 'NewInboxRule' in the client body, indicating an attempt to create a new inbox rule.