Assessing suspicious Outlook rules: an exercise

This guide trains analysts to spot malicious Outlook inbox rules by evaluating the logical association between rule names, conditions, and actions; it presents ten anonymized real examples with verdicts and reasoning, outlines heuristics (e.g., suspicious use of default folders, global delete rules, inconsistent naming), and gives investigation tips and caveats for accurate triage.