Suspicious mailbox rule created to hide/forward finance threads

Ibrahim Saud@tektrix

•updated Sep 19, 2026•2•0•3

Detects the creation of email mailbox or transport rules that perform actions like hiding, deleting, marking as read, forwarding, or redirecting emails with finance or payment-related keywords. This behavior is indicative of a Business Email Compromise (BEC) post-exploitation workflow where adversaries attempt to conceal malicious activity or divert financial communications.