Inbox Rule Created to Hide Security Notifications
Detects a new mailbox rule that deletes, moves, redirects, or marks as read messages containing security, sign-in, MFA, alert, or administrator terms. This behavior is often indicative of an adversary attempting to hide their activities or prevent detection by preventing security notifications from reaching the user.
Microsoft Sentinel (KQL)
