Payroll Pirate M365 Inbox Rule Hiding Direct Deposit and HR Keywords

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•4

Detects the creation or modification of Exchange Online inbox rules that either contain specific sensitive keywords (e.g., payroll, bank, direct deposit) or perform actions that hide, delete, or move messages. This behavior is commonly used by attackers to intercept sensitive communications or conceal evidence of their presence in a compromised mailbox.