The Gmail filter visibility limit in InboxGuards

Here's a real scenario. An attacker gets into a Gmail account — a phished password, a reused one from a breach. They don't forward anything. They don't download anything. They create one Gmail filter: "if a message contains the word invoice, delete it." Or subtler: "mark replies from this vendor as read and archive them."

That filter can run on Google's servers whether anyone is signed in or not. The audit records used by InboxGuards do not expose user-created Gmail filter changes, so InboxGuards cannot detect the filter being created.

InboxGuards uses supported records Google exposes through its Admin SDK Reports API, such as selected sign-in, forwarding, app-authorization, and administrative events.

The event records used by InboxGuards do not include user-created Gmail filter changes. Google may change editions, APIs, and event coverage, so evaluate current provider documentation and the exact data source a product uses.

A malicious filter can conceal mail and may appear alongside other compromise activity. Related activity does not always produce a record available to InboxGuards.

InboxGuards checks supported forwarding, app-grant, sign-in, and Google security-verdict records when Google exposes the required fields. Provider, edition, configuration, retention, and API limits still apply.

• ■Supported Gmail forwarding event — checked and alerted when required fields are available
• ■Supported third-party app grant — checked when Google exposes the event
• ■Supported sign-in record — checked against configured location rules
• ■Google's own "hijacked account" and "suspicious login" flags — surfaced after Google provides and InboxGuards processes the event
• ■Repeated failed sign-ins followed by a success — the password-guessing signature, alerted as critical

Review filters manually in Gmail: open Settings → See all settings → Filters and Blocked Addresses. Investigate any filter that deletes, archives, or marks mail as read when the account owner does not recognize it.

A relevant InboxGuards alert can be a reason for an authorized administrator to review filters, but the presence or absence of an alert does not prove whether a malicious filter exists.

InboxGuards is an alarm on configured supported signals, not an all-seeing shield. It does not guarantee visibility into every account change or incident.

On Google Workspace, InboxGuards checks supported forwarding, security-verdict, app-grant, password-guessing, and sign-in records. User-created Gmail filter rules remain outside its current data source and require separate review.