{"id":4051,"date":"2026-06-08T18:02:18","date_gmt":"2026-06-08T15:02:18","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4051"},"modified":"2026-06-08T18:02:18","modified_gmt":"2026-06-08T15:02:18","slug":"what-is-suspicious-hidden-inbox-rules-option-on-inbox-rule-scanning-feature-in-collaboration-protection","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/what-is-suspicious-hidden-inbox-rules-option-on-inbox-rule-scanning-feature-in-collaboration-protection\/","title":{"rendered":"What is &#8220;suspicious hidden inbox rules&#8221; option on inbox rule scanning feature in Collaboration Protection."},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>What is &quot;suspicious hidden inbox rules&quot; option on inbox rule scanning feature in Collaboration Protection.<\/p>\n<h3>Resolution:<\/h3>\n<p>Detect suspicious inbox rule where attacker tries to move content between hidden folders to remain undetected.<br \/>Attackers use these kinds of rules to manipulate the original mailbox user, remain undetected in the mailbox, and may simultaneously perform internal phishing campaigns using the compromised mailbox.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What is &#8220;suspicious hidden inbox rules&#8221; option on inbox rule scanning feature in Collaboration Protection.<\/p>\n","protected":false},"template":"","support_article_product":[101],"class_list":["post-4051","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000013193","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:02:18","import_hash":"7c87ffbfc0ee4bec476bd5566b227c43bc5e74cd","vanilla_article_id":31628,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/31628-what-is-suspicious-hidden-inbox-rules-option-on-inbox-rule-scanning-feature-in-collaboration-protection","vanilla_kb_id":30,"vanilla_category_id":124,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4051"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}