Glossary
Email hiding rule
A mailbox filter that archives, deletes, marks as read or moves messages so the real user never sees them; a hallmark of BEC.
An email hiding rule is a mailbox filter created to keep messages away from the legitimate user. In Gmail that means a filter that removes the INBOX or UNREAD label, or sends matching mail to Trash or Spam. Attackers key these on words like "invoice", "payment" or "bank details", so that supplier replies and fraud warnings disappear.
Gmail filters are mailbox settings, not audit events. You find them through the Gmail API (users.settings.filters) or the user's settings. The Gmail log shows their effect (archive and trash events). MITRE: T1564.008.