Suspicious Inbox Rule for Phish Suppression

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•2

Detects post-compromise inbox rule creation that moves security/phishing alerts to a folder and marks them as read. This behavior is often associated with adversaries attempting to hide their activities or prevent detection.