Post-compromise mailbox BEC monitoring ops (Forg365 Account Intel)

Ibrahim Saud@tektrix

•updated Aug 3, 2026•1•0•5

Detects post-compromise mailbox operations consistent with Forg365 BEC monitoring: new inbox/mail-forwarding rule creation, keyword listener/alert configuration, viewer-link creation for shared inbox access, or M365 mailbox search activity following account takeover