TP: If you can affirm that inbox rule was created by an OAuth 3rd-social gathering application with suspicious scopes delivered from an mysterious source, then a true positive