Microsoft Exchange Security Alert Email Deletion
Detects the deletion or movement to deleted items of emails containing security-related keywords such as MFA, sign-in alerts, password resets, or security notifications. This behavior indicates potential anti-forensics or defense evasion tactics by an attacker attempting to hide evidence or buy time.
Cortex XDR
