Azure mailbox rule creation

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: Azure Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Collection (TA0009) Defense Evasion (TA0005)
ATT&CK Technique	Email Collection: Email Forwarding Rule (T1114.003) Indicator Removal: Clear Mailbox Data (T1070.008)
Severity	Informational

A Mailbox rule in Azure was created.

Intercept or exfiltrate sensitive information.

Investigate the rule's details and confirm its legitimacy.
Look for any unusual behavior originated from the suspected identity, and check if they're compromised.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A Mailbox rule in Azure was created.

Intercept or exfiltrate sensitive information.

Investigate the rule's details and confirm its legitimacy.
Look for any unusual behavior originated from the suspected identity, and check if they're compromised.