Exchange Inbox Rule Creation or Modification to Risky Folder

Information hacker@Informationhacker

•updated Feb 10, 2026•16•1•215

Detects the creation or modification of Exchange inbox rules that move messages to potentially risky folders (e.g., Deleted Items, Junk Email, RSS Feeds, Archive, Clutter) or are configured to delete messages. This behavior can be indicative of an attacker attempting to hide malicious emails, exfiltrate data, or disrupt email flow.