Detect Outlook rules by auditing mailbox rule changes, especially new forwarding, deletion, redirection, or auto-move rules created outside normal user behaviour. Review anomalous logons, impossible travel, and rule creation from unfamiliar clients or scripts. Alert when rules hide security messages, forward mail externally, or move important mail into low-visibility folders without a clear business reason.
How Outlook rules become a detection problem
Outlook rules are often a mailbox persistence and exfiltration mechanism, so the goal is not just to see that a rule exists, but to spot rules that change mail handling in ways the user would not normally do. That means focusing on creation, modification, and deletion activity, plus the mailbox context around the change.
In practice, the strongest signal is a new rule that forwards mail externally, deletes or redirects messages, or quietly moves important mail into low-visibility folders. Those behaviors matter most when they appear after an unusual sign-in or from a client the user does not normally use.
Security teams should treat the rule itself as evidence of a possible follow-on action, not a standalone event. A suspicious rule often matters because it is paired with a compromised session, a scripted mailbox action, or a mailbox takeover pattern that keeps the attacker hidden after the initial access.
What to look for in mailbox telemetry and user behavior
Detection works best when mailbox audit data is correlated with sign-in and client activity. Review rule creation events alongside anomalous logons, impossible travel, unfamiliar user agents, and automation or script-based access that does not match the account’s normal pattern. The Persistence Techniques Guide is useful here because Outlook rules are one of several common ways attackers maintain quiet access after compromise.
Look for rule conditions and actions that are operationally odd for the user, such as rules that hide security alerts, auto-forward to a personal or external address, or route invoices, password resets, and approval messages away from the inbox. Also watch for rule names, folder targets, and senders that appear suddenly after a login from a new device or location.
It is also worth checking for rule churn. Attackers often create, edit, and then remove rules to reduce the chance of later review, so repeated changes in a short window can be more revealing than a single rule event.
When rule activity is suspicious, what should the investigation prove?
The key question is whether the rule reflects legitimate business use or mailbox abuse. That usually comes down to intent, timing, and blast radius: did the rule appear during normal work, does it affect only expected traffic, and does it expose sensitive mail outside the tenant or hide messages that matter to security or finance?
If the answer is unclear, investigate whether the mailbox also showed token abuse, session hijack behavior, or a change in forwarding settings at the tenant or client layer. A suspicious Outlook rule rarely lives alone; it often sits inside a broader compromise path that includes credential theft, session reuse, or persistence through mail flow changes. The MITRE ATT&CK Enterprise Matrix is a useful reference for mapping those behaviors to attacker tactics such as credential access, persistence, and defense evasion.
The highest-value checks are whether the rule was created from an unexpected client, whether mail is being sent outside the organization, and whether the rule is suppressing alerts or moving high-value mail to folders the user is unlikely to inspect. That combination is far more actionable than looking at the rule count alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1098 — Account Manipulation | Mailbox rule abuse often follows account takeover and persistence behavior. |
| Recommendation — Map suspicious mailbox changes to account manipulation and hunt for related persistence activity. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Outlook rule abuse is detected through anomalous mailbox and sign-in monitoring. |
| Recommendation — Monitor mailbox and identity events for abnormal rule creation and forwarding changes. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Mailbox rule changes should be reviewed as auditable events for compromise detection. |
| Recommendation — Review audit records for rule changes, forwarding actions, and unusual mailbox administration. | ||
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Mailbox rules can be abused to hide activity and operate through delegated or automated access paths. |
| Recommendation — Restrict human misuse of delegated mailbox access and alert on hidden mail-routing changes. | ||
Practitioner Guidance
What to verify: Confirm the rule owner, creation time, client type, and destination address, then compare them with normal mailbox behavior and recent sign-in history. If the rule forwards externally or suppresses security mail, treat it as a likely compromise signal until proven otherwise.
Decision rule: If a mailbox rule changes message visibility, creates external delivery, or appears after suspicious authentication activity, prioritize containment and credential/session review before debating whether the user intended it. If the rule is benign but unusual, document the business rationale and keep it under heightened monitoring.
Practitioner takeaway: Outlook rule detection is strongest when you correlate mailbox changes with sign-in anomalies, because the rule is usually the persistence or exfiltration step, not the whole incident.