M365 hidden inbox rules deleting or hiding payroll/deposit/bonus mail

ills3c Intel&Coffee@Ills3C

•updated yesterday•6•0•14

Detects the creation or modification of inbox rules in Exchange Online that target financial-related keywords and hide/delete mail, or rules that mark all incoming mail as read and delete them, which may indicate a Business Email Compromise (BEC) attack or mailbox evasion technique.