Topic starter
14/07/2026 4:26 pm
TL;DR: Malicious mailbox rules are being used to hide alerts, forward mail, and preserve access after compromise, according to Proofpoint. Microsoft 365 needs rule-level monitoring because password resets alone do not remove the attacker’s view of the mailbox.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Mailbox rules in O365—a post-exploitation tactic in cloud ATO”.
By the numbers:
- Approximately 10% of compromised user accounts had at least one malicious mailbox rule created shortly after initial access in Q4 2025.
Key questions
Q: Why do malicious mail rules increase the impact of business email compromise?
A: Malicious mail rules matter because they let attackers automate stealth, exfiltration, and persistence after they get into a mailbox.
Q: How can security teams detect mailbox-rule abuse early?
A: Watch for new rules that forward externally, delete messages, or route mail into obscure folders, especially when they appear within minutes of account compromise.
Q: What breaks when malicious mailbox rules are not monitored?
A: When mailbox rules are not monitored, attackers can hide security alerts, suppress password resets, redirect vendor mail, and preserve covert access after the initial compromise.
Practitioner guidance
- Audit inbox rule creation as a compromise signal Review newly created forwarding, deletion, and move rules alongside recent sign-ins, especially when the rule appears soon after first access or uses minimal, nonsensical names.
- Disable external auto-forwarding by default Block automatic forwarding to external addresses unless there is a documented business need and a monitored exception path.
- Revoke sessions after rule discovery Invalidate active sessions and refresh tokens when malicious rules are found so access does not persist after password change.
Bottom line: Mailbox rules can function as a stealth persistence layer inside Microsoft 365, allowing attackers to hide mail, suppress alerts, and maintain visibility after compromise.
Glossary terms: Mailbox Rule Abuse, Mail-Flow Persistence, Thread hijacking, Hidden Folder Suppression
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
14/07/2026 5:07 pm
Mailbox rules are now a persistence control boundary, not an inbox feature: The security significance of native rule creation is that it changes how long a compromised identity can remain operational. If password resets do not remove the rule, then the persistence condition lives outside the password lifecycle. Practitioners should treat rule creation as evidence that the identity has crossed from access abuse into post-compromise control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do after a mailbox is used to send malicious internal email?
A: They should disable the account, force a password reset, contain any endpoints that interacted with the message, and remove any remaining malicious email. After that, they should review authentication logs, mailbox rules, and access policies to prevent the same path from recurring.
👉 Read our full editorial: Mailbox rules are a stealth persistence layer in Microsoft 365