What happens when attackers use inbox rules after they compromise an email account?

How inbox rules turn a mailbox compromise into persistence

Inbox rules are attractive to attackers because they let a stolen email account keep behaving “normally” while quietly changing what the victim sees. A compromised mailbox can still send and receive mail, but the attacker can redirect, hide, or suppress messages that would otherwise expose the intrusion. That makes the rule set part of the persistence layer, not just a cleanup detail.

Once an attacker controls the account, the main advantage is control over message flow. They can auto-forward sensitive mail out of the environment, delete or archive replies from IT or security teams, and filter out password reset or MFA-related notifications. That preserves access longer and makes remediation harder because the victim loses both visibility and timely warnings.

Inbox rules also widen the blast radius. Email is often the coordination point for password resets, invoice approvals, vendor communication, and internal trust decisions, so rule abuse can expose more than the original mailbox. It can create follow-on access to other accounts, support more convincing phishing or business email compromise, and give the attacker an early view of incident response activity.

Why inbox-rule abuse is effective after initial access

Rule abuse works because mail systems are designed to automate routine filtering, and defenders often trust those automations unless they look closely at post-compromise configuration changes. An attacker does not need to break encryption or bypass the mail platform if they can simply alter message handling at the account level. The abuse is low-noise, fast to deploy, and easy to blend into normal user behaviour.

From a defensive perspective, the dangerous part is not just exfiltration. It is the combination of stealth and leverage: attackers can observe who is responding, suppress recovery steps, and keep the victim from seeing indicators that the account is being used elsewhere. That is why inbox rules are often treated as an intrusion persistence and containment issue, not merely a mail hygiene issue.

One practical reference point is the broader identity abuse pattern captured in the Ultimate Guide to NHIs, which notes that many organisations still struggle with visible, well-governed secret and account control; the same governance weakness is what lets post-compromise mail rules persist unnoticed.

Detecting and containing rule abuse before it becomes a full breach

The most useful signals are changes that do not fit the user’s normal mail habits: newly created forwarding rules, unexpected deletion or auto-archive actions, hidden inbox filters, and rules that target security alerts, password resets, or messages from finance and executives. Mailbox compromise often becomes obvious only after these rule changes are correlated with unusual sign-in activity or a sudden lack of expected notifications.

Current guidance suggests focusing on both the mail content path and the identity path. Review mailbox rules when you see impossible travel, anomalous device access, or suspicious OAuth consent activity, because attackers often combine multiple account-control methods. When the account is important enough to trigger resets, approvals, or external communications, even a small rule change can create disproportionate downstream impact.

• Check for forwarding destinations outside the organisation.
• Look for rules that delete, move, or mark as read messages from security, IT, or finance.
• Review whether password reset, MFA, and executive messages are being suppressed.
• Preserve the exact rule set and recent audit trail before making changes.

For practitioner context, the compromise pattern is well illustrated by the 52 NHI Breaches Report and the Microsoft Midnight Blizzard breach, both of which show how attackers use access preservation and message visibility to extend control after the initial foothold.

Practitioner Guidance: Treat mailbox-rule changes as evidence of active post-compromise control until proven otherwise, not as benign user customisation. The first decision should be whether the rule is preserving attacker visibility or suppressing recovery, because that determines whether you rotate credentials, revoke sessions, and isolate the mailbox before you investigate anything else.

Practitioner takeaway: Inbox rules matter because they convert one stolen mailbox into a durable access and monitoring foothold, so the real control objective is to detect rule tampering early enough that the attacker cannot use email itself to manage the rest of the compromise.

Related resources from NHI Mgmt Group

• What happens when attackers use a compromised email account to move through connected SaaS apps?
• What happens when an email account is compromised and attackers use it to launch lateral phishing?
• What happens when attackers compromise a trusted account and use it to push a malicious link to followers?
• What happens when attackers use Windows remote management tools after compromise?