DEF CON 34 – Vitaly Simonovich – C(2)YA-style adversary persistence inside a mailbox (inbox rule + OAuth grant combo)
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
Microsoft Sentinel (KQL)
