BEC Evidence Suppression: Inbox Rule Creation Following Device Code Sign-In

Renata Cardoso@rcardososec

•updated Jul 6, 2026•0•0•4

Detects the creation or update of mailbox inbox rules within 30 minutes of a successful sign-in event using the OAuth device code flow. This sequence is often observed in Business Email Compromise (BEC) attacks where an attacker uses a stolen or phished device code to access a mailbox and subsequently establishes persistence via malicious mail forwarding or deletion rules to hide their tracks.