Critical 2026 Detection — Malicious Inbox Auto-Forward Rule Created After Accoun

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects the creation of mailbox inbox rules (New-InboxRule) or modification of mailbox forwarding configurations (Set-Mailbox) that auto-forward, auto-delete, or move messages to hidden or secondary folders (e.g., RSS, Deleted Items). This behavior is characteristic of Business Email Compromise (BEC) follow-on activity intended to maintain covert access to victim communications, particularly following account takeover events like password resets.