How to know "intruder" create email filter

[Fadly]

Dear All,
Can anyone help me find out which domain the email filter has been added to.
because there was an incident where an intruder added an email filter on several accounts in a certain domain in my Cpanel account.
Thank You

 

[cPRex]

Hey there! I'm sorry to hear about this issue. The best place to check for that behavior would be the logs at /usr/local/cpanel/logs/access_log as that would show any actions taken inside the cPanel interface.

I often find it is easier to perform the work myself one time while watching that log file, as then I can see exactly what I need to search for.