Malicious inbox rule
A mail rule an attacker creates in a compromised mailbox to hide their activity from the real owner.
Almost every mailbox compromise includes one. A rule is set to move replies containing words like invoice, payment, or bank straight to a rarely-checked folder or the deleted items, so the legitimate user never sees the conversation the attacker is running in their name.
It is one of the most reliable indicators of compromise available, because ordinary users very rarely create rules that delete incoming mail based on financial keywords. Alerting on new rule creation catches BEC in progress rather than after the payment has left.
Where this comes up
Malicious inbox rule sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.