Administrative Mail Rule Change from an Anonymous Proxy

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•7

Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.