What are the signs that an email account may have malicious inbox rules?

How malicious inbox rules reveal attacker intent

Mailbox rules are powerful because they act after a message arrives and before the user notices it. When rules are created to forward mail elsewhere, delete specific messages, or hide mail that mentions sensitive subjects, the pattern usually reflects intent to preserve access, reduce visibility, or intercept responses. Security teams should treat the rule logic, not just the existence of a rule, as the signal.

Rules that target password reset language, security alerts, executive names, finance terms, or investigation-related phrases are especially telling because they are built to interfere with recovery and detection. A legitimate user may create simple organisation or spam-handling rules, but attackers tend to author rules that change message flow in a way that supports persistence or concealment.

For teams looking for a baseline on what suspicious identity-driven abuse looks like more broadly, the patterns align with OWASP Non-Human Identity Top 10 themes around excessive privilege, secret exposure, and lifecycle abuse, and with operational guidance in NIST Cybersecurity Framework 2.0 for detecting abnormal access behaviour.

What patterns are most suspicious in practice

The most suspicious inbox rules usually fall into a few families. Forwarding rules are dangerous when they send mail to an unknown address or an external mailbox the user never approved. Deletion rules are suspicious when they remove messages from a particular sender, subject, or keyword set, especially if the mail relates to login activity, finance, or internal reviews. Filtering or move rules become concerning when they hide mail in an obscure folder rather than simply sorting ordinary correspondence.

Another important pattern is selective treatment. A rule that suppresses messages from an executive, legal, HR, security, or finance mailbox can be more meaningful than a broad spam filter because it shows the attacker is shaping which conversations the victim sees. The same applies when rules target terms such as “reset,” “verification,” “invoice,” or “investigation,” since those terms often map to account recovery or fraud detection workflows.

Mailbox review should also look for rules that appear technically valid but operationally odd, such as unusually complex conditions, long exception lists, or rules created shortly after a suspicious login. Those details often indicate the rule was written by an intruder who understood enough about the mailbox to conceal follow-on activity. When the behaviour resembles credential abuse or mailbox tampering, incident responders often cross-check it against known abuse paths such as Microsoft Midnight Blizzard breach and Poland Military Breach, where email compromise exposed sensitive communications.

Risk and Threat Considerations

Malicious inbox rules matter because they can turn a one-time mailbox compromise into ongoing surveillance, message suppression, or business email compromise. The risk is not limited to the original account, because hidden messages can delay detection, intercept password resets, and misdirect internal or external responses.

Failure mechanism: An attacker who gains mailbox access creates rules that silently forward, delete, or hide specific messages, which preserves access after the initial login and reduces the chance that the victim notices security alerts or recovery attempts.

Impact: The result can be account persistence, missed remediation, fraudulent payment activity, or lateral movement through trusted communication threads, especially when the mailbox belongs to an executive, finance user, or security-sensitive role.

Practitioner Guidance

What to prioritise: Start with rules that export mail externally, delete messages from security or recovery senders, or suppress mail containing reset, verification, approval, or investigation keywords. Those rules are the most likely to indicate active concealment rather than routine inbox organisation.

What to verify: Confirm when each suspicious rule was created, from which session or device, and whether the mailbox also shows recent sign-in anomalies, delegated access, or unfamiliar forwarding settings. If the rule appeared near the time of a suspicious login, treat it as part of the same incident until proven otherwise.

Practitioner takeaway: Inbox rules are not just mailbox hygiene, they are often the attacker’s persistence layer, so the real question is whether the rule changes message visibility in a way that would help an intruder stay hidden or block recovery.

Related resources from NHI Mgmt Group

• Why do compromised passwords create such a high account takeover risk even when users meet complexity rules?
• How should teams reduce risk from malicious npm package installs?
• How should teams respond when a service account token is exposed?
• How should security teams detect malicious inbox rules that use Unicode obfuscation?