Techniques
Sample rules
Suspicious Inbox Manipulation Rules
- source: sigma
- technicques:
- t1140
Description
Detects suspicious rules that delete or move messages or folders are set on a user’s inbox.
Detection logic
condition: selection
selection:
riskEventType: mcasSuspiciousInboxManipulationRules