Rapid deletion of security notification emails correlated with password-reset/MFA change
This rule detects potentially malicious activity where an attacker, having performed a password reset or MFA change on a compromised account, attempts to hide their tracks by rapidly deleting security-related notification emails (e.g., password reset alerts) shortly after they arrive in the user's mailbox. It correlates Exchange mailbox operations with audit log account security changes to filter out routine noise.
Microsoft Sentinel (KQL)
