Hidden inbox rule "."/".." created with StopProcessingRules forwarding

Ankit Mehta@Secvyn

•updated Sep 12, 2026•2•0•5

Detects the creation of email inbox rules in Microsoft 365 where the rule name is exceptionally short ('.' or '..') and the rule performs potentially malicious actions such as forwarding, redirecting, or deleting incoming messages. This is a common technique used by attackers to hide malicious email activity or exfiltrate sensitive data from a compromised account.