Hey everyone,
We've been dealing with phishing attempts, including some socially engineered, targeted ones. One of our shared inboxes had a rule created that had the URL of a legitimate organization marked as read and deleted, while we were getting emails from a very similar fake address that was off by one letter.
I've asked the team if they created the rule in earnest, and we also have two factor verification set up on all of the accounts, so I'm wondering how this rule got created. Is there a way for someone to create rules when they wouldn't have access to the actual mailbox? Something like a malicious script running when an email got opened? If there is some way, how do you prevent it from happening in the future?
I tried searching for something like this, but all of the results would come up about creating a rule to block malicious email, and not malicious email creating rules.
Thanks,
Bryan
