Risky M365 sign-in followed by mailbox rule creation and internal phishing send
Detects a sequence of suspicious activities where a risky or anomalous Entra ID sign-in is followed by the creation or modification of inbox rules (such as deleting, moving, or marking messages as read) and a subsequent burst of outbound emails from the same user account.
Microsoft Sentinel (KQL)
