By Eric Corcoran, Posted in Technology Week in Review
Monday 4/13
Mailbox rules in O365—a post-exploitation tactic in cloud ATO (Proofpoint)
Mailbox rules are a high-risk post-exploitation tactic.?Attackers abuse native mailbox rules for exfiltration, persistence, and communication manipulation. Combined with third-party services and domain spoofing, attackers can hijack threads, impersonate victims, and manipulate vendor communications, all without network-level interception.
https://www.proofpoint.com/us/blog/threat-insight... read more.