Phishing Series 2026: BEC Mailbox-Rule Manipulation for Reply-Chain Hijacking
Detects the creation or modification of inbox rules (e.g., forwarding, redirecting, deleting, or moving to hidden folders) that target finance, invoice, or payment-related communications, occurring shortly after an initial user sign-in from a new or unseen country/ASN within the last 30 days. This pattern is indicative of a post-compromise activity where an adversary attempts to exfiltrate financial data or hide malicious email activity.
Microsoft Sentinel (KQL)
