How do attackers use Outlook Rules?

How Outlook Rules Support Post-Compromise Persistence

Attackers usually use outlook rules after they already control a mailbox. The rules become a quiet automation layer that changes where mail goes, what the user sees, and what evidence remains visible in the inbox. That makes them especially useful for interception of sensitive conversations, business email compromise, and long-dwell access.

A rule can be far more valuable than a single stolen login because it keeps working even after the attacker stops actively signing in. If the mailbox belongs to an executive, finance user, administrator, or vendor contact, the attacker can keep harvesting messages and waiting for the next useful thread, attachment, or reset link.

Rules also help attackers reduce noise. They can move security alerts, legal notices, password resets, or suspicious replies out of sight, which lowers the chance that the account owner notices tampering quickly. In practice, the rule is both an exfiltration path and a concealment mechanism, which is why it often sits alongside other mailbox persistence techniques. NHIMG’s Persistence Techniques Guide covers the wider set of attacker methods used to maintain access after initial compromise.

What Attackers Change Inside the Mailbox

Most malicious Outlook Rules fall into a small set of behaviours: forward mail to an external address, redirect selected messages to another folder, delete mail before the user sees it, mark messages as read, or apply keywords and categories that hide them from normal attention. The exact combination depends on what the attacker wants to preserve, such as stealth, message collection, or selective diversion of high-value threads.

The forward-and-delete pattern is especially dangerous because it creates two effects at once. The attacker receives the message, and the victim has less reason to suspect that mail is missing. In more targeted cases, attackers build rule logic around sender, subject line, or content terms so that only messages from banks, payroll, help desks, or named executives are diverted.

Outlook Rules are not limited to one vendor or one operating system behaviour. The underlying idea is simple: once the mailbox is compromised, the attacker uses built-in message processing to turn the victim’s inbox into a forwarding and filtering engine. That makes rule review a valuable investigative step even when the initial sign-in event looks old or inconclusive. A broader attacker perspective is summarised in The State of NHI & AI Agent Breach Report 2026, which includes real-world patterns of compromised identities and post-access abuse.

How Defenders Should Interpret Rule Abuse

Rule abuse should be treated as evidence of active mailbox control until proven otherwise. A harmless-looking forwarding rule may be the only durable sign that the account has already been used for interception, lateral abuse, or follow-on fraud. The investigation should therefore focus on who created the rule, when it appeared, what messages it targets, and whether the destination is inside or outside the organisation.

External forwarding is the highest-value signal because it can move business data out of the tenant with very little user-visible friction. Internal forwarding or hidden-folder redirection can still be malicious, especially when the attacker wants to avoid drawing attention while preserving access to future threads. On privileged or high-value accounts, rule creation should be correlated with sign-in history, consent grants, password resets, and any unusual changes to mailbox settings.

For defenders, the practical test is not whether the rule is technically valid, but whether it matches the user’s normal workflow and approved mail handling. If it does not, treat it as a control failure in both detection and account hygiene. Mailbox rule abuse is one of the most common ways an attacker converts a single compromise into repeatable access.

Risk and Threat Considerations

Malicious Outlook Rules matter because they turn a one-time compromise into persistent, low-noise access to email content. That creates direct exposure of confidential messages, reset flows, approval chains, and business-sensitive replies, while also giving attackers a way to suppress evidence that the mailbox is being monitored.

Failure mechanism: The attacker gains mailbox control, then uses built-in rule processing to forward, hide, or delete messages before the legitimate user notices. Because the behaviour occurs inside ordinary mail handling, it can blend into normal activity unless teams inspect rule changes and forwarding destinations.

Impact: Sensitive mail can be intercepted repeatedly, security notifications can be suppressed, and the account can remain useful for fraud or follow-on compromise long after the initial login was stolen.

Practitioner Guidance

What to verify: Check whether the rule was created or changed after an unusual sign-in, password reset, consent event, or device change. On high-value mailboxes, verify the full rule set, not just obvious forwarding, because attackers often chain conditions to target specific senders or subjects.

Decision rule: If a rule forwards outside the organisation, hides security notices, or appears on an executive, finance, or admin mailbox without a clear business need, treat it as a compromise indicator and escalate immediately. If the mailbox is important to operations, rotate the account recovery path and review adjacent access for misuse.

Practitioner takeaway: Outlook Rules are not just an inbox convenience issue, they are a post-compromise persistence mechanism, so rule changes should be investigated with the same urgency you would apply to suspicious forwarding, token abuse, or mailbox takeover.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?