Skip to content

Commit f9c28cc

Browse files
authored
minor changes to ensure CI testing works
1 parent be4fcbe commit f9c28cc

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

detections/cloud/o365_suspicious_mailbox_rule_created.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: O365 Suspicious Mailbox Rule Created
22
id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
33
version: 1
44
date: '2025-02-14'
5-
author: 0xC0FFEEEE
5+
author: '0xC0FFEEEE, Github Community'
66
type: TTP
77
status: production
88
description: This analytic detects suspicious mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers.
@@ -37,6 +37,7 @@ rba:
3737
- field: user
3838
type: user
3939
score: 25
40+
threat_objects: []
4041
tags:
4142
analytic_story:
4243
- Office 365 Account Takeover

0 commit comments

Comments
 (0)