Detection Engineering
Mailbox Rules, Forwarding, and Delegation Detection
Detect mailbox rules, forwarding, delegation, and permission changes by separating configuration, authority, message effect, and legitimate workflow context.