Inbox Rule MarkAsRead and MoveToFolder

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•5

Detects the creation or modification of inbox rules that automatically mark emails as read and move them to a folder. This behavior is commonly used by adversaries to hide phishing replies or other malicious email activity from the victim's primary inbox.