A municipal mailbox may have new forwarding and inbox rules after a suspected email compromise. Which sources should the analyst pull?
Select an answer to reveal the explanation.
Short Explanation
Inbox rules do not live in the pump historian. Pull the mail gateway and the mailbox audit trail—that is where forwarding and hidden rules show up after a civic BEC or account takeover.
Full Explanation
Business email compromise and mailbox account takeover are investigated with mail-gateway telemetry plus identity/mailbox audit (for example Microsoft 365 mailbox audit showing forwarding and inbox rules). SCADA historians, physical badge logs, and DNS recursor logs answer other questions and do not record mailbox-rule changes. Pairing gateway and mailbox audit gives both message-path and persistence-in-the-mailbox evidence.