Malicious inbox rules are hidden email settings that attackers create to redirect, delete, or conceal messages. They are a common post-compromise tactic in human and NHI account takeovers, especially when an attacker uses stolen credentials to maintain access, intercept alerts, and mask suspicious activity from users and security teams.
What malicious inbox rules are and why attackers use them
Malicious inbox rules are a persistence and concealment tactic, not just an email preference setting. Once an attacker has mailbox access, rules can automatically move, delete, forward, or mark messages so the compromise is harder to notice and easier to keep using.
The main danger is that the mailbox keeps working “normally” from the user’s perspective while important messages quietly disappear or get rerouted. That makes malicious rules especially useful after account takeover because they help the attacker stay hidden without needing to remain logged in interactively.
How inbox rules support post-compromise persistence
Inbox rules become powerful when the attacker already has credentials, a session, or delegated mail access. They can suppress security alerts, hide password reset emails, and redirect conversations that would otherwise expose the intrusion, which turns a one-time login into a longer-lived foothold.
This is why malicious rules are often discussed alongside mailbox takeover, business email compromise, and identity abuse. They are a follow-on control abuse, the kind that extends the value of stolen access by manipulating mail flow rather than breaking authentication again.
What to look for in a compromised mailbox
Suspicious rules often do one of a few things: forward mail to an unfamiliar address, move messages to RSS, Archive, Deleted Items, or obscure folders, delete security notifications, or apply conditions that target specific senders such as finance, IT, or password reset services.
Unusual rule names, recently created rules that the user does not recognise, hidden forwarding destinations, and sudden gaps in alert delivery are all warning signs. In practice, investigators should treat inbox-rule changes as an indicator of likely mailbox compromise, especially when paired with sign-in anomalies or new OAuth consent events.
Why malicious inbox rules matter for identity security
Because email is often the recovery channel for other accounts, compromised inbox rules can create a wider identity impact than the mailbox itself. Attackers may capture reset links, session notifications, and approval emails, which can let them pivot into adjacent systems and preserve access even after the original password is changed.
The issue is especially serious in environments where mailboxes are tied to payment workflows, privileged administration, or shared operational alerts. A hidden rule can turn stolen access into durable control over business communications, making the compromise harder to detect and recover from.
Risk and Threat Considerations
Malicious inbox rules create both concealment risk and control-loss risk. They let an attacker shape what the user sees, what defenders see, and which messages arrive on time, which can delay incident detection and extend compromise after the initial intrusion.
Failure mechanism: After credential theft or session compromise, the attacker creates or modifies mailbox rules to suppress alerts, hide evidence, and route valuable messages to an attacker-controlled destination.
Impact: The organisation can lose visibility into account takeover, miss password resets or payment approvals, and allow the intrusion to persist long enough for broader identity abuse or fraud.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1114 — Email Collection | Malicious inbox rules are a mail-content access and concealment technique used after mailbox compromise. |
| Recommendation — Map suspicious mailbox-rule changes to email collection activity and hunt for hidden message interception. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Mailbox-rule creation and forwarding events need auditable records for compromise detection and review. |
| Recommendation — Log mailbox-rule changes and forwarding actions so investigators can reconstruct post-compromise behavior. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The term depends on detecting covert mailbox-rule abuse through retained and reviewable logs. |
| Recommendation — Centralize and review mail-system audit logs for rule creation, forwarding, and deletion activity. | ||
| NIST CSF 2.0 | DE.CM-01 — The organization monitors networks and systems to find potential cybersecurity events | Hidden inbox rules are a detectable post-compromise event that monitoring should surface. |
| Recommendation — Monitor email platforms for rule changes, forwarding, and alert-suppression behavior. | ||
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Mailbox compromise often abuses the human-mail identity boundary to maintain unauthorized access. |
| Recommendation — Treat mailbox-rule abuse as unauthorized use of an identity-bearing email account and rotate exposed access. | ||
Practitioner Guidance
What to watch for: Review mailbox-rule changes as part of account-takeover triage, especially when a user reports missing mail, unexpected forwarding, or unexplained loss of security alerts. Rule creation is often one of the earliest persistence steps after email compromise.
Governance implication: Mailbox-rule creation and external forwarding should be monitored, logged, and periodically reviewed as a security control, not treated as a benign user convenience. Where possible, tie mailbox hygiene to compromise recovery so altered rules are removed before resetting trust in the account.
For broader email-abuse patterns and related hardening topics, the Email Identity and BEC Guide covers mailbox takeover and inbox-rule abuse in the context of email impersonation.
The Microsoft 365 Security Guide is also useful when inbox-rule persistence appears in Exchange or broader Microsoft 365 investigations.