Most Popular Detection 2026: Business Email Compromise Mailbox Rule Manipulation
This rule detects potentially malicious inbox rule creation or modification in Office 365 Exchange. It flags rules that contain keywords associated with financial fraud (e.g., invoice, wire, payment) and include actions that hide evidence (e.g., moving messages to junk or deleting them). It further correlates these actions with suspicious user login activity, such as logging in from a new IP address or country within an hour of the rule change, which is a common indicator of a Business Email Compromise (BEC) account takeover.
Splunk (SPL)
