How to Investigate a Malicious Inbox Rule in Microsoft 365
A practical playbook for investigating a suspicious Microsoft 365 inbox rule: read the rule, scope the account, check what mail was exposed and contain it cleanly.
3 Nov 20269 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
2 posts found
How to Hunt for Hidden Scheduled Tasks on Windows Servers
Find scheduled tasks hidden by deleting their SD registry value, as seen with Tarrask, using registry telemetry, Task Scheduler logs and a read only estate sweep.
23 Oct 20268 min read