Tycoon2FA - Post-AiTM Inbox Rule Evasion (T1098.005)
Detects the attacker leveraging a stolen session token to create or modify inbox rules that move finance or payroll related emails to the Archive or Trash folders, or delete them, as observed in Tycoon2FA phishing campaigns.
Microsoft Sentinel (KQL)
