[MSAPI-EXCHANGE] Domain Wide Emails Moved to Deleted Items v1

alert any any any -> any any (msg:"[MSAPI-EXCHANGE] Domain Wide Emails Moved to Deleted Items v1"; program:Exchange; json_meta_content:".Operation",New-InboxRule,Set-InboxRule; content:"Deleted Items"; content:"FromAddressContainsWords
| 22 2c 22
| Value
| 22 3a 22
| @"; parse_src_ip:1; classtype:suspicious-activity; reference:url,https://redcanary.com/blog/threat-detection/email-forwarding-rules/; reference:url,https://www.splunk.com/en_us/blog/security/hunting-m365-invaders-dissecting-email-collection-techniques.html; sid:5017922; rev:1; metadata:created_at 2026_05_14, updated_at 2026_05_14, mitre_tactic_id TA0009, mitre_technique_id T1114;)