Suspicious Inbox Rule Creation
Detects creation of malicious Exchange Online inbox rules used for BEC and account-takeover persistence. Normalizes both client logging paths, OWA (New-InboxRule) and Outlook desktop (UpdateInboxRules + AddMailboxRule), and flags rules with hidden names (., ,, blank, 1 to 2 chars), external forwarding, or move/delete actions paired with payment (ach, wire, invoice) or security-notification (password, MFA, Microsoft) keywords, especially with stop-processing/exit-after-execution set.
Cortex XDR
