Mailbox rule created to hide/forward finance-themed messages post-compromise

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

Detects the creation of suspicious O365 inbox rules designed to hide (via mark-as-read, move, or delete actions) or forward/redirect email messages containing keywords associated with financial transactions such as payment, wire, or invoice. This behavior is indicative of post-compromise activity, specifically targeted at invoice fraud or email thread hijacking.