TP: If you can confirm that the OAuth app is shipped from an not known resource, and redirects to a suspicious URL, then a true positive is indicated.FP: If you're able to confirm that app established an inbox rule to a fresh or individual exterior e-mail account for respectable causes.Answerthepublic is a wonderful Resource for content creators. I