Outlook Rules are mailbox rules that automatically sort, forward, move, or delete email based on defined conditions. Attackers abuse them after mailbox compromise to hide alerts, redirect messages, or maintain persistence. Defenders should review newly created forwarding or deletion rules, especially those that affect security notifications or external destinations.
What Outlook Rules Do
Outlook Rules are mailbox automation controls that can sort, forward, move, or delete messages based on conditions. In a security context, they matter because a compromised mailbox can be turned into a quieter, harder-to-notice channel for hiding alerts or steering email away from the owner.
How Outlook Rules Are Used in Abuse and Persistence
Attackers often create or modify rules after mailbox compromise to reduce visibility into security notifications, customer replies, or password reset messages. The abuse is operationally simple, but effective: if the right messages never reach the inbox, the victim may not see signs of takeover or remediation.
This is why mailbox rule review is a routine part of post-compromise investigation. A rule that forwards mail to an external address, deletes security alerts, or silently moves messages to an unexpected folder can be a durable indicator of malicious control.
What to Review in Suspicious Mailbox Rules
The highest-value checks are the ones that reveal message diversion, concealment, or unauthorized external delivery. That includes newly created forwarding rules, deletion rules, rules that target security-related senders, and rules that redirect mail outside the organisation.
Rule review should also consider scope and timing. A harmless-looking rule can still be dangerous if it was created immediately after a suspicious sign-in, if it affects messages from identity providers or security tools, or if it is paired with other mailbox changes such as inbox delegation or new trusted devices.
Why Outlook Rules Matter to Incident Response
Mailbox rules are not just convenience features, they can become part of the attacker’s control path inside email-centric workflows. When they are abused, they can preserve access, suppress alerts, and make recovery slower by interfering with user visibility and defender notifications.
For that reason, post-incident review should treat mailbox rules as evidence of both exposure and persistence. Even after the original sign-in issue is corrected, the rules can continue to divert mail until they are discovered and removed.
Risk and Threat Considerations
Abused mailbox rules create a direct visibility and persistence risk. They are especially dangerous when they hide password resets, MFA prompts, or security alerts, because the victim and the defender may both lose sight of ongoing compromise.
Failure mechanism: The attacker changes rule logic so important messages are automatically moved, deleted, or forwarded before the user sees them, which weakens detection and can keep the compromise alive.
Impact: The organisation may miss account recovery attempts, delayed compromise signs, or continued message interception, which increases the chance of account takeover, fraud, and broader lateral abuse through email workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1114.003 — Email Collection: Email Forwarding Rule | Outlook Rules abuse is a classic email-forwarding persistence and collection mechanism. |
| Recommendation — Hunt for rule creation and forwarding activity when investigating mailbox compromise. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Mailbox rule changes need review and analysis to spot unauthorized email diversion. |
| Recommendation — Review mailbox rule audit events for suspicious forwarding, deletion, or filtering changes. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Rule abuse is detectable through log collection and review of mailbox configuration changes. |
| Recommendation — Log and review mailbox rule changes to detect message-diversion abuse early. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Suspicious mailbox-rule changes are an anomalous event that should be monitored. |
| Recommendation — Monitor mailbox configuration changes for unexpected rule creation or modification. | ||
Practitioner Guidance
What to watch for: Treat recently added forwarding, deletion, and inbox-filtering rules as high-priority signals, especially when they affect security notifications or send mail to external destinations.
Governance implication: Review mailbox-rule creation and modification as a security control, not just a user preference feature. If the environment supports it, centralise alerting on suspicious rule changes so rule abuse is visible quickly after compromise.
Related resources from NHI Mgmt Group
- What is the difference between a rules-based secret scanner and a hybrid scanner?
- What is the difference between static access rules and evidence-based access decisions?
- When does context-aware DLP matter more than rules-based inspection?
- Why do token-based attacks often evade standard detection rules?