TP: If you can verify that inbox rule was made by an OAuth 3rd-occasion application with suspicious scopes delivered from an mysterious supply, then a real positive is detected. Evaluate consent grants to your application produced by end users and admins. Investigate all actions done via the application, Specifically https://jamess257vzb4.blog2freedom.com/profile