Password reset followed by verified deletion of multiple security notifications
Detects a password reset followed by the deletion of two or more verified security-notification emails (matched to actual notification sender domains) within 24 hours, prioritizing permanent deletions as higher-confidence evidence-destruction behavior.
Microsoft Sentinel (KQL)
