Multi-Stage Email Disruption Rule (T1098.005)
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
Microsoft Sentinel (KQL)
