Hacker News Reader

I was about to comment the same thing. It's very simple but I don't think I would have thought of it

It's quite common, in fact my "go-to" hacked account rule in Office 365 is "alert me, system admin, anytime anyone creates an outlook/exchange rule".

Our group is small enough that I get very few alerts at all, and I've caught two compromises that way.

Thanks for the tip that's a pretty good one I wouldn't have thought of

Do you know if those alerts can also be set up on Google Admin?