08/14/2026
Inbox rules are supposed to make work easier. After account takeover, they can also help attackers stay quiet.
Vectra AI MDR research found that attackers tend to create their own mailbox rules rather than rewrite a user’s existing ones, using them to forward, move, or delete messages.
Dr. Stephan Hoehl explains what SOC teams should watch and how analyst decisions can make detection sharper.
Read more: https://www.vectra.ai/blog/attackers-create-inbox-rules-they-dont-rewrite-yours