Just found the second instance of a rule called "Untitled" being created in Outlook 2013. It moves email with 'password' or 'virus' or 'malware' or 'phishing' or 'phished' (etc..) to the deleted items

Just found the second instance of a rule called "Untitled" being created in Outlook 2013. It moves emails with 'password' or 'virus' or 'malware' or 'phishing' or 'phished' (etc..) to the deleted items folder. It's more annoying than malicious because people are not getting certain emails to their inbox (each of the 2 rules had something unique added to the list probably from the subject of an email on the users machine).

The only thing on the internet so far for this issue has gone unanswered, at the following link:
https://social.technet.microsoft.com/Forums/office/en-US/a45a640a-1b66-4935-b378-26e9a1604f0d/outlook-2010-email-rule-untitled-created?forum=outlook
DiTechOpsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

strivoliCommented:
Disable that Rule. If the Rule is created automatically each time you open Outlook, try opening Outlook in Safe Mode. There must be an Add-On (your AV or AntiSpam SW?) that creates that Rule itself.
0
DiTechOpsAuthor Commented:
No add-ons creating the rules and we have disabled without it popping back up, just concerned that 2 machines and possibly more have this rare issue happening to them. If it was created by an anti-virus program or even some weird combination of clicks in Outlook itself, a google search should turn up something yet does not.
0
DiTechOpsAuthor Commented:
Finally found what was going on. Incase anyone else runs into this here is the report on it.


Report: FIN4 hacker tactics and security measures to thwart attacks

https://www2.fireeye.com/rs/fireye/images/rpt-fin4.pdf
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DiTechOpsAuthor Commented:
Definitive answer as to what was/is going on.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Email Software

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.