LoFP / T1564.008

T1564.008

Title	Tags
legitimate administrative changes for business needs.	t1114.003 T1564.008 o365 tenant splunk
short rule names may trigger false positives. adjust the entropy and length thresholds as needed.	T1564.008 o365 tenant splunk
users may create email rules for legitimate purposes. filter as needed.	t1114.003 T1564.008 o365 tenant splunk