Attackers Create Inbox Rules. They Don't Rewrite Yours. by Stephan Hoehl

This Vectra AI analysis describes how threat actors abuse Microsoft 365 mailbox rules following account takeover: attackers typically create new, minimally named rules, prefer default folders when moving mail, rarely delete mail (which is a strong signal), and use forwarding as a gray area. The report recommends encoding these behavioral patterns into SOC scoring and detection workflows to reduce noise and prioritize genuinely suspicious accounts.