Suspicious inbox manipulation rule

RIDGELINE CIVIL  ·  AL-88214  ·  TUE 09:22 AWST

You're the tier-2 security analyst at a Perth MSP. Ridgeline Civil is a 45-person civil contractor in Kalgoorlie on Microsoft 365 Business Premium.

It's Tuesday morning. A Defender alert has just landed in your queue. Work through it. Open the evidence before you answer.

Evidence

Decision