ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: AF027.003
  • Created: 11th August 2025
  • Updated: 17th August 2025
  • Contributor: The ITM Team

Inbox Rule Deletion

The subject deletes one or more inbox rules from their email client or server mailbox configuration to conceal the prior existence of automated message handling behaviors. Unlike auto-forwarding rules, which redirect messages externally, inbox rules typically perform local actions such as moving messages to folders, deleting them upon receipt, or marking them as read.

 

Deleted rules can complicate retrospective investigations by eliminating a clear audit trail of how emails were processed, hidden, or discarded during an investigation's timeframe.