Watch for new forwarding, hiding or deletion rules appearing right after a suspicious sign-in, especially when they target security alerts, payroll mail or executive communications. Those rules often signal that the attacker is trying to suppress warnings and keep access alive after the initial compromise.
Mailbox rules as an account takeover indicator
Mailbox rules become suspicious when they appear soon after a sign-in anomaly and they change what the mailbox owner can see, save, forward or delete. The most telling patterns are rules that suppress alerts, move messages out of view, or redirect business-critical mail to another destination, because those changes help an intruder stay hidden while maintaining access to the account.
The key signal is not just that a rule exists, but that it changes mail handling in a way the legitimate user would not normally choose. A new rule that targets security notifications, password resets, payroll mail, executive correspondence or vendor approvals is materially different from a routine inbox organiser because it can support persistence and concealment after compromise.
Mailbox rules also matter because they often operate quietly. Many users will notice a missed email before they notice a compromised login, so rule changes can be one of the earliest durable traces of mailbox abuse. That makes them useful as both a detection clue and a scoping clue for how far the attacker may have gone inside the account.
What suspicious mailbox rules usually do
Rules used in account takeover usually fall into a few recognizable patterns. They may forward messages externally, delete them immediately, mark them as read, move them to an obscure folder, or filter by keywords associated with security or finance. In practice, the attacker is trying to reduce the chance that the victim or security team sees evidence of the takeover.
Another pattern is selective handling rather than broad disruption. Attackers often avoid breaking the mailbox completely because they want the account to keep functioning. A rule that leaves most mail untouched but quietly suppresses only high-value messages is often more dangerous than a noisy rule that changes everything, because it is designed for stealth and longer dwell time.
A particularly strong indicator is rule creation that references alerts from identity providers, banks, payroll systems or collaboration tools. Those messages often contain reset links, approval prompts or fraud warnings, so redirecting or deleting them gives the attacker room to operate without immediate interruption.
Why mailbox rules signal persistence, not just access
Mailbox rules are important because they show the attacker is trying to turn a single login event into continuing control. Once an intruder can shape inbox flow, they can monitor responses, intercept resets, and hide replies that would otherwise expose the compromise. That is why rule abuse is often treated as evidence of post-compromise activity rather than a simple mail configuration issue.
This is especially relevant when the account belongs to finance, HR or leadership. Those mailboxes carry approvals, invoices, compensation details and sensitive internal conversations, so even a narrow rule can have high impact. If the mailbox is used for business processes, a hidden forwarding or deletion rule can enable fraud, impersonation or unauthorized approval flows.
Mailbox rule abuse also fits broader account takeover patterns seen in email identity and BEC guidance, because the mailbox becomes both the control point and the concealment layer. When the attacker can shape what arrives and what disappears, the account is no longer just accessed, it is being operationalised.
Risk and Threat Considerations
Mailbox rules are risky because they can hide the signs of compromise while preserving attacker visibility into future mail. That combination makes them useful for credential theft follow-on activity, business email compromise and fraud, especially when the attacker targets messages that carry resets, approvals or payment instructions.
Failure mechanism: The attacker gains mailbox access, creates or alters rules to forward, suppress or delete selected messages, and then uses those rules to maintain stealth and intercept high-value communications.
Impact: Security teams may miss the compromise window, the user may not see reset or warning emails, and the attacker can sustain unauthorized access long enough to escalate fraud or impersonation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1114 — Email Collection | Mailbox-rule abuse supports covert collection and mail interception after compromise. |
| T1098 — Account Manipulation | Rule changes alter account behaviour to maintain attacker control after takeover. | |
| Recommendation — Map hidden mail handling to T1114 and hunt for suspicious inbox-rule creation. Investigate mailbox-rule changes as account manipulation and scope adjacent persistence. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Mailbox-rule abuse is often confirmed through mail audit and sign-in logs. |
| Recommendation — Retain mailbox audit logs and alert on rule creation after anomalous sign-ins. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Mailbox-rule abuse is detectable by reviewing mail and authentication events together. |
| AC-2 — Account Management | Mailbox-rule persistence is an account governance issue after compromise. | |
| Recommendation — Correlate mailbox audit events with login anomalies and investigate rule changes. Review and remediate account changes, including unauthorized mailbox-rule modifications. | ||
Practitioner Guidance
What to verify: Check whether rule creation aligns with an unusual sign-in, new device, impossible travel event or MFA challenge. If the rule appeared at roughly the same time as a suspicious login, treat it as part of the compromise chain rather than as a standalone mailbox setting.
What good looks like: Legitimate rules are usually few, stable and easy to explain. A healthy mailbox should not contain hidden forwarding, silent deletion or selective filtering of alerts unless there is a documented business need and an owner who can justify it.
Decision rule: If a mailbox rule touches security alerts, payment mail or executive communications, prioritize containment, credential reset and rule review before trying to prove whether the attacker already acted on the mailbox contents. The question is not just whether access happened, but whether the mailbox was modified to support ongoing abuse.
Practitioner takeaway: A suspicious mailbox rule is valuable because it often reveals the attacker’s intent to stay invisible, so the fastest path to judgment is to correlate the rule with the sign-in event, the target messages and any downstream forwarding or deletion behaviour.
Related resources from NHI Mgmt Group
- What breaks when attackers create mailbox rules after account takeover?
- What are the signs that a GitHub account takeover is being used to erase or exfiltrate code?
- What are the signs that cloud account takeover tooling is being used against an organisation?
- What are the signs that SharePoint or OneDrive account takeover is being used as part of a phishing campaign?