TP: If you're able to validate the publisher domain or redirect URL in the app is typosquatted and won't relate on the correct identification in the application.This detection identifies an OAuth Application that consented to suspicious scopes, results in a suspicious inbox rule, then accessed buyers mail folders and messages from the Graph API.FP: