Topic starter
14/07/2026 4:26 pm
TL;DR: Attackers are abusing native Microsoft 365 mailbox rules to exfiltrate data, suppress alerts, and sustain access after password resets, with Proofpoint observing malicious rules on about 10% of compromised accounts in Q4 2025. Mailbox rules are no longer a user convenience feature in identity terms, they are a persistence control boundary that many programmes still do not monitor.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Mailbox rules in O365—a post-exploitation tactic in cloud ATO”.
By the numbers:
- Approximately 10% of compromised user accounts had at least one malicious mailbox rule created shortly after initial access in Q4 2025.
Key questions
Q: What breaks when malicious mailbox rules are not monitored?
A: When mailbox rules are not monitored, attackers can hide security alerts, suppress password resets, redirect vendor mail, and preserve covert access after the initial compromise.
Q: Why do malicious mail rules increase the impact of business email compromise?
A: Malicious mail rules matter because they let attackers automate stealth, exfiltration, and persistence after they get into a mailbox.
Q: How can security teams detect mailbox-rule abuse early?
A: Watch for new rules that forward externally, delete messages, or route mail into obscure folders, especially when they appear within minutes of account compromise.
Practitioner guidance
- Audit inbox rule creation as a compromise signal Review newly created forwarding, deletion, and move rules alongside recent sign-ins, especially when the rule appears soon after first access or uses minimal, nonsensical names.
- Disable external auto-forwarding by default Block automatic forwarding to external addresses unless there is a documented business need and a monitored exception path.
- Revoke sessions after rule discovery Invalidate active sessions and refresh tokens when malicious rules are found so access does not persist after password change.
Bottom line: Mailbox rules can function as a stealth persistence layer inside Microsoft 365, allowing attackers to hide mail, suppress alerts, and maintain visibility after compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:07 pm
Mailbox rules are now a persistence control boundary, not an inbox feature: The security significance of native rule creation is that it changes how long a compromised identity can remain operational. If password resets do not remove the rule, then the persistence condition lives outside the password lifecycle. Practitioners should treat rule creation as evidence that the identity has crossed from access abuse into post-compromise control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do after a mailbox is used to send malicious internal email?
A: They should disable the account, force a password reset, contain any endpoints that interacted with the message, and remove any remaining malicious email. After that, they should review authentication logs, mailbox rules, and access policies to prevent the same path from recurring.
👉 Read our full editorial: Mailbox rules are a stealth persistence layer in Microsoft 365