Storm-2755 inbox rule creation correlated by SessionID to Datawagon AS27176 sign-in and mail access
Detects creation of malicious Exchange inbox rules (move to Deleted Items / mark as read) correlated via SessionId to an interactive sign-in from the Datawagon hosting ASN (27176) and a subsequent MailItemsAccessed event, consistent with Storm-2755 AiTM session-replay and mailbox-hiding persistence.
Microsoft Sentinel (KQL)
