Huntress detected a suspicious inbox rule in the Microsoft 365 mailbox | Voters

Huntress detected a suspicious inbox rule in the Microsoft 365 mailbox

Invited Member

Could this report also include the date the rule was created? This way we could see if this correlates with a previous known incident.

James Ramsey

I feel like any rule moving mail from the Inbox to "Conversation History" or "RSS Feed" should instantly trigger an account lock.