How do attackers use Mailbox Rules Abuse?

Attackers use Mailbox Rules Abuse to hide malicious email, redirect copies of messages, or delete alerts after compromising an account. They create rules that forward finance requests, suppress security notices, or move evidence into hidden folders. Defenders should review inbox rules, watch for new forwarding destinations, and alert on rule changes after suspicious sign-in activity.

How Mailbox Rules Abuse Works in a Compromised Inbox

mailbox rules abuse is attractive because it turns a legitimate email feature into a persistence and concealment layer. After account compromise, attackers can use rules to suppress alerts, route sensitive mail to hidden folders, or auto-forward messages that support fraud, extortion, or further access. The abuse is often quiet, which makes mailbox settings part of the investigation, not just the message stream.

The key practitioner point is that rule abuse is usually a post-access move. It tends to follow stolen credentials, a malicious session, or consent granted to a suspicious mail client, then uses the mailbox itself to reduce defender visibility and keep the intrusion alive.

What Attackers Try to Gain from Mailbox Rules

Attackers use rules to control what the victim sees and what the defender notices. Common goals include hiding invoices, banking alerts, password resets, or internal security notifications; copying mail to an external destination; and burying evidence in folders that are rarely reviewed. In business email compromise, this can keep a payment conversation flowing even after the original account takeover is detected.

Because rules operate inside the mailbox, they can blend into ordinary user behaviour unless teams compare recent changes against the account’s normal mail patterns. The abuse becomes more dangerous when a rule also interacts with retention, archive, or auto-delete behaviour, since that can remove the very evidence analysts need to reconstruct the timeline.

What Defenders Should Check First

Start with the mailbox rule set, not just the login event. Look for new forwarding destinations, unexpected keyword-based moves, deletion rules for security mail, or actions that mark mail as read and file it away. If the rule appeared after an unusual sign-in, treat it as part of the compromise chain rather than a harmless configuration change.

For response, the most useful evidence is the combination of rule changes, session history, and message flow. Confirm whether the mailbox sent mail externally, whether any alerting channel was suppressed, and whether the attacker changed additional settings such as forwarding, delegation, or OAuth consent. NHIMG’s Email Identity and BEC Guide is the best starting point when the abuse is part of an email impersonation or payment-fraud path.

Risk and Threat Considerations

Mailbox Rules Abuse creates more than a visibility problem, because it can preserve attacker access, suppress detection, and redirect high-value business mail into an attacker-controlled workflow. The risk is highest where email is used for approvals, invoices, password resets, or incident notifications, since the attacker can manipulate both communication and response timing.

Failure mechanism: A rule is created or altered after mailbox compromise to forward, hide, delete, or auto-process messages, which reduces defender visibility and can keep the intrusion operational without obvious user disruption.

Impact: The attacker can sustain fraud, harvest sensitive correspondence, delay detection, and interfere with containment because the mailbox continues to function while evidence is quietly diverted or suppressed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1114 — Email Collection	Mailbox rules abuse supports attacker email concealment and harvesting from compromised accounts.
Recommendation — Map mailbox rule anomalies to T1114 and hunt for hidden forwarding or auto-delete behavior.
NIST SP 800-53 Rev 5	AC-2 — Account Management	Mailbox rules abuse often follows account compromise and requires lifecycle review of mailbox settings.
	AU-6 — Audit Record Review, Analysis, and Reporting	Mailbox rule changes and related sign-ins need audit review to detect abuse quickly.
	IA-5 — Authenticator Management	Compromised credentials or sessions commonly enable rule abuse and need rapid credential control.
Recommendation — Review account settings and revoke unsafe mailbox changes during incident response. Correlate mailbox rule changes with sign-in logs and alert on suspicious rule creation. Reset exposed credentials and invalidate sessions after mailbox-rule compromise.
OWASP Non-Human Identity Top 10	NHI-10 — Human Use of NHI	Mailbox automation and forwarding can be abused by humans to manipulate message handling and visibility.
Recommendation — Restrict human-driven use of mailbox automation to approved, reviewable purposes.

Practitioner Guidance

What to verify: Check whether the mailbox has recent rule creation, hidden forwarding, or inbox actions that differ from the user’s baseline. Compare those changes with sign-in logs and any suspicious consent events so you can tell whether the rule is the symptom or the persistence mechanism.

Decision rule: If a rule sends mail outside the organisation or suppresses security notices, treat it as a containment trigger, not a housekeeping issue. Remove the rule, review other mailbox settings, and validate that the attacker did not establish a second path through forwarding, delegation, or connected apps.

Practitioner takeaway: The important judgment is to treat mailbox rules as an attacker-controlled control plane once compromise is suspected, because the same feature that helps users manage email can also be used to hide evidence and extend access.