Overe Deep Scanner now checks every mailbox for enabled inbox rules that move incoming email into the RSS Feeds ( or other hidden folders ) This is a known technique used by attackers during business email compromise (BEC) to conceal messages from the account owner and sustain access without detection.

The check runs against current inbox rules, including hidden rules and rules that were created before Overe was connected to the tenant. It does not rely on audit log availability or the rule creation event being present in the tenant's logs.

When you run a Deep Scan on a tenant, Overe automatically checks all mailboxes for rules that match this pattern. No additional configuration is required.

If a suspicious rule is found, a finding is added to the scan results.