TP: If you can ensure that inbox rule was created by an OAuth 3rd-bash app with suspicious scopes sent from an unknown supply, then a real positive is indicated. Verify whether or not the app is vital towards your Business prior to contemplating any containment actions. Deactivate the app