Security teams can detect email hiding rules by checking for mailbox rules that move, delete, forward, or mark messages as read without a clear business reason. They should alert on newly created hidden rules, unusual rule changes, and sign-in activity linked to the affected mailbox, then review for token theft or account takeover.
What email hiding rules usually do in a mailbox
email hiding rules are mailbox-side automation that changes what a user sees after mail arrives. In practice, the rule may move messages into another folder, delete them, mark them as read, forward them elsewhere, or otherwise reduce visibility. That is why investigators treat them as a mailbox-level concealment mechanism rather than a harmless productivity setting.
The key question is not whether a rule exists, but whether it matches the user’s normal mail flow. Rules that silently remove invoice threads, security alerts, password resets, or executive mail are especially important because they can block the mailbox owner from seeing the very messages that would reveal compromise.
For teams building a review path, the most useful baseline is the normal behavior of the mailbox, not the existence of rules alone. A rule created by a user for a clear workflow is different from a hidden or recently changed rule that appears after a suspicious sign-in or token event. NHIMG’s Email Identity and BEC Guide is a useful companion when you need to connect inbox-rule abuse with mailbox takeover and email impersonation patterns.
How to detect suspicious hiding behavior
The most effective detection logic looks for intent and timing. Alert when a mailbox rule moves, deletes, forwards, or marks messages as read without an obvious business need, and give extra weight to rules that target high-value messages such as login alerts, finance mail, or internal security notifications. New hidden rules are more important than old, stable rules because they often appear during or just after compromise.
Detection also improves when you correlate rule creation with sign-in activity. A hidden rule created shortly after a risky login, unfamiliar device access, unusual geolocation, impossible travel, or consent grant is more suspicious than the same rule appearing during routine use. If the mailbox shows rule changes and concurrent authentication anomalies, treat the rule as a possible post-compromise cover-up mechanism.
Mailbox telemetry should include rule creation, edits, deletion, forwarding changes, and any administrative action that could mask mail flow. The best signal is not a single rule event, but a pattern: a new rule plus unusual mailbox activity plus evidence that mail is no longer being read by the owner. For investigators, that combination is often stronger than message loss alone. MITRE ATT&CK Enterprise Matrix helps map the surrounding activity to credential access and account compromise behaviors.
High-signal message paths are worth special attention. If the rule filters security notices, MFA prompts, password reset mail, or payment-related conversation threads, it may be preserving attacker access or suppressing user awareness. A rule that forwards mail externally is also a major indicator because it can create a parallel mail stream outside the tenant while leaving the mailbox apparently healthy. NHIMG’s Email Security Guide helps place these observations in the broader email control stack.
What to do after you find a hidden rule
Once a suspicious rule is identified, confirm whether the mailbox was actually used for theft or just for concealment. Review recent logins, delegated access, OAuth grants, forwarding destinations, sent mail, deleted items, and any newly added recovery settings. If the rule appeared after a suspicious sign-in, assume the mailbox may have been used by an attacker until the timeline proves otherwise.
If patching or hardening work is not the immediate issue, the operational priority is containment. Remove the rule, preserve evidence, and check whether the same actor created other rules, added inbox forwarding, or changed recovery options across more than one account. If a service account, shared mailbox, or executive mailbox is involved, widen the review because attackers often use a compromised mailbox to watch for follow-on opportunities rather than to send obvious spam.
When the mailbox is part of a broader email control program, compare the observed rule behavior to your expected anti-phishing and post-delivery response workflow. Some teams discover that the rule is only one symptom of a larger compromise path that includes stolen tokens, consenting apps, or session hijacking. NHIMG’s Email Security Buyer’s Guide is a practical reference for aligning detection with post-delivery remediation and business email compromise controls.
Risk and Threat Considerations
Hidden mailbox rules matter because they create stealth, not just message loss. An attacker who can suppress alerts or move mail out of view can keep control longer, harvest information quietly, and reduce the chance that the account owner notices account takeover. That makes inbox rules a detection problem as much as an access problem.
Failure mechanism: The attacker gets a valid mailbox session, then creates or alters a rule to hide evidence, intercept responses, or redirect valuable mail. The mailbox continues to function, but the user no longer sees the messages that would reveal the compromise.
Impact: The organization can lose visibility into authentication alerts, invoice threads, executive mail, and incident notifications, which increases dwell time and can enable fraud, lateral social engineering, or further account abuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006 — Credential Access | Mailbox hiding rules often follow account compromise and stolen session access. |
| Recommendation — Correlate rule changes with credential access activity and hunt for takeover paths. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Mailbox-rule anomalies require review of logs and correlated sign-in evidence. |
| IA-5 — Authenticator Management | The question explicitly calls for checking token theft or account takeover behind the rule. | |
| Recommendation — Review mailbox and sign-in logs for suspicious rule creation and edits. Rotate or revoke exposed authenticators and sessions after suspected mailbox compromise. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection depends on retaining and alerting on mailbox-rule and sign-in events. |
| Recommendation — Centralize and alert on mailbox-rule and authentication events for suspicious changes. | ||
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Forwarding or hiding rules can expose non-human mail access paths and misuse signals. |
| Recommendation — Check whether automation or delegated access is masking the true mailbox user. | ||
Practitioner Guidance
What to verify: Check whether the rule’s target, action, and creation time line up with the user’s role and recent activity. A rule that affects only ordinary newsletters is lower concern than one that filters identity, finance, or executive mail.
Decision rule: If a mailbox rule appears after suspicious sign-in activity, treat it as a compromise indicator first and a convenience feature second. Investigate the access path before trusting the mailbox state.
What good looks like: Teams should be able to see who changed the rule, when it changed, what mail it affects, and whether the mailbox still receives critical mail in the user’s view. If you cannot answer those questions quickly, the detection surface is too weak.
Practitioner takeaway: The most important judgment is to treat inbox rules as evidence of mailbox control, not just configuration drift, because concealment often tells you more about compromise than the missing messages themselves.