Attackers use inbox rule persistence by creating hidden mail rules that forward, delete, move, or mark messages as read so they can keep access and hide evidence. They often target security alerts, reset links, and financial messages. Defenders should review mailbox rules, audit delegated access, and investigate unexpected forwarding or deletion behaviour.
How inbox rule persistence works as an access foothold
Attackers use inbox rule persistence to turn email access into a quiet control point. Once they can create or change rules, they can keep messages out of sight, reshape the victim’s view of the mailbox, and preserve access to future traffic without needing to stay logged in constantly. The technique is useful because email often carries resets, approvals, invoices, and security notifications.
A mailbox rule is a small control with outsized impact. A malicious rule can delete or archive a message before the user sees it, move it into a low-visibility folder, forward it to an attacker-controlled address, or mark it read so it no longer draws attention. In practice, the attacker is not just hiding evidence, they are steering which messages the account owner notices first.
This persistence becomes more valuable when the mailbox is part of business processes. If the account receives approval chains, customer communication, or financial correspondence, a rule can be used to intercept high-value mail while leaving the mailbox apparently normal. That is why email impersonation and BEC controls matter as much as password hygiene: the abuse often lives inside ordinary mail handling, not only at login.
What attackers try to hide or harvest
Inbox rule persistence is usually paired with selective targeting. Attackers often watch for password reset links, MFA enrolment messages, payment notices, account-change confirmations, and internal security alerts because those messages reveal when defenders are closing the door or when a new access path can be captured. A rule that diverts only those messages can keep the compromise stable for longer.
Rules can also be used to reduce user suspicion. If security notifications disappear, the victim may not realise there is an active compromise. If key mail is redirected to a folder that looks routine, the mailbox still appears functional while the attacker monitors the same stream. This is why mailbox rule abuse is often discussed alongside broader email takeover and mailbox auditing in Microsoft 365.
In mature intrusions, inbox rules are rarely the only persistence mechanism. They often sit beside delegated access, stolen sessions, OAuth mail permissions, or other mail-plane abuse. That combination is dangerous because one weak control can mask the others, and defenders may focus on password resets while the mailbox itself remains quietly weaponised.
What defenders should inspect first
The most useful starting point is not a full mailbox hunt, but a focused review of the highest-risk rule behaviours. Look for rules that forward externally, suppress notifications, auto-delete messages, mark messages as read, or move mail to obscure folders. Then compare the rule set with recent sign-in activity, delegated mailbox access, and any changes in forwarding configuration.
For incident response, the practical question is whether the rule is still actively shaping mailbox flow. If suspicious mail is being diverted, responders should treat it as both an access indicator and a concealment control. A mailbox can look healthy while the attacker is still receiving resets, alerts, or transaction mail through a hidden path. That is why a broad review of identity attack techniques and persistence helps teams connect mailbox behaviour to broader account compromise.
Mailbox rules are especially important in environments where email is a control plane for business approvals. If a rule is altering the visibility of finance or security mail, the investigation should expand beyond the mailbox owner and check who can create rules, who can grant delegated access, and whether any automation or client has permission to modify mail flow.
Risk and Threat Considerations
Inbox rule persistence is risky because it converts a successful mailbox compromise into durable, low-noise access. The attacker does not need continuous interactive control if the mailbox itself keeps filtering alerts, proof-of-action messages, and recovery links away from the user.
Failure mechanism: A malicious rule changes message flow before the user or SOC sees it, which suppresses alerting, hides evidence of abuse, and preserves the attacker’s ability to monitor future mail.
Impact: The compromise can last longer, recovery becomes harder, and the attacker can intercept resets, approvals, invoices, or other sensitive mail without immediate detection.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1098 — Account Manipulation | Mailbox rules are a persistence and account-manipulation method. |
| Recommendation — Map mailbox-rule abuse to account manipulation and hunt for post-compromise changes. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Mailbox-rule abuse is found by reviewing mailbox and audit activity. |
| IA-5 — Authenticator Management | Mailbox-rule persistence often follows credential or session compromise. | |
| Recommendation — Review mailbox and audit logs for rule creation, forwarding, and delegation changes. Rotate exposed credentials and revoke sessions when mailbox control is suspicious. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Mail platforms and automation interfaces can be abused through weak auth paths. |
| Recommendation — Validate mailbox and API authentication paths that can create or alter rules. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Delegated mailbox access and rule changes are access-control issues. |
| Recommendation — Remove unnecessary delegated mail access and limit who can alter mailbox flow. | ||
Practitioner Guidance
What to verify: Confirm whether any rule forwards outside the tenant, moves mail from security or finance senders, or marks sensitive messages as read. If the mailbox has delegated access, verify whether the rule was created by the owner or by someone acting through another access path.
Decision rule: If a rule affects reset, alerting, or payment-related mail, treat it as a high-priority compromise indicator even when the account otherwise appears normal. If the rule only changes convenience behaviour with no security impact, it is lower priority but still worth recording for context.
Practitioner takeaway: Inbox rule persistence matters because it hides the evidence that would normally reveal the compromise. The key judgement is whether the rule is merely cluttering mail, or actively steering recovery, alerting, or financial messages away from the people who need to see them.