Skip to content

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.

Glossary

Email hiding rule

A mailbox filter that archives, deletes, marks as read or moves messages so the real user never sees them; a hallmark of BEC.

An email hiding rule is a mailbox filter created to keep messages away from the legitimate user. In Gmail that means a filter that removes the INBOX or UNREAD label, or sends matching mail to Trash or Spam. Attackers key these on words like "invoice", "payment" or "bank details", so that supplier replies and fraud warnings disappear.

Gmail filters are mailbox settings, not audit events. You find them through the Gmail API (users.settings.filters) or the user's settings. The Gmail log shows their effect (archive and trash events). MITRE: T1564.008.

See: finding a hacker's Gmail forwarding rule.

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.