Anomalous Email Rule Creation By Compromised Account

Tim Peck@timpeck

•updated Dec 23, 2025•9•1•200

Detects suspicious email inbox rule creation indicative of account compromise. Focuses on rules with randomly-generated names or rules that move emails to low-visibility folders combined with hiding actions (mark as read, delete, stop processing).